From: Manish Honap <[email protected]> Excluding a BAR sub-range from mmap is not enough on its own: the region read/write path still reaches the underlying registers. Refuse an access that overlaps the excluded range there too, so the only way in is the provider's trap.
Signed-off-by: Manish Honap <[email protected]> --- drivers/vfio/pci/vfio_pci_rdwr.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c index 7f14dd46de17..2ce18e75a5ae 100644 --- a/drivers/vfio/pci/vfio_pci_rdwr.c +++ b/drivers/vfio/pci/vfio_pci_rdwr.c @@ -223,6 +223,10 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_core_device *vdev, char __user *buf, count = min(count, (size_t)(end - pos)); + /* An excluded sub-range is reached only through its trap. */ + if (vfio_pci_bar_is_excluded(vdev, bar, pos, count)) + return -EINVAL; + if (bar == PCI_ROM_RESOURCE) { /* * The ROM can fill less space than the BAR, so we start the @@ -423,6 +427,10 @@ int vfio_pci_ioeventfd(struct vfio_pci_core_device *vdev, loff_t offset, pos >= vdev->msix_offset + vdev->msix_size)) return -EINVAL; + /* An excluded sub-range is reached only through its trap. */ + if (vfio_pci_bar_is_excluded(vdev, bar, pos, count)) + return -EINVAL; + if (count == 8) return -EINVAL; -- 2.25.1
