On Mon, May 10, 2021 at 04:55:39PM +0200, Daniel Vetter wrote: > yeah vfio is still broken for the case I care about. I think there's > also some questions open still about whether kvm really uses > mmu_notifier in all cases correctly, IIRC kvm doesn't either. > > Daniel I suppose we missed this relation to follow_pte(), so I agree > > that keeping a unsafe_follow_pfn() around is not good. > > tbh I never really got the additional issue with the missing write > checks. That users of follow_pfn (or well follow_pte + immediate lock > dropping like vfio) don't subscribe to the pte updates in general is > the bug I'm seeing. That v4l also glosses over the read/write access > stuff is kinda just the icing on the cake :-) It's pretty well broken > even if it would check that. It is just severity. Exploiting the use after free bug is somewhat harder, exploiting the 'you can write to non-page write protected memory' bug is not so hard. Jason
