On Tue, Mar 09, 2021 at 12:26:07PM -0700, Alex Williamson wrote:
> In the new series, I think the fault handler becomes (untested):
>
> static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
> {
> struct vm_area_struct *vma = vmf->vma;
> struct vfio_pci_device *vdev = vma->vm_private_data;
> unsigned long base_pfn, pgoff;
> vm_fault_t ret = VM_FAULT_SIGBUS;
>
> if (vfio_pci_bar_vma_to_pfn(vma, &base_pfn))
> return ret;
>
> pgoff = (vmf->address - vma->vm_start) >> PAGE_SHIFT;
I don't think this math is completely safe, it needs to parse the
vm_pgoff..
I'm worried userspace could split/punch/mangle a VMA using
munmap/mremap/etc/etc in a way that does update the pg_off but is
incompatible with the above.
Jason
