[PATCH v4 13/27] vfio/pci: Refuse read/write to an excluded BAR sub-range

[mhonap]

From: Manish Honap <mhonap@xxxxxxxxxx>

Excluding a BAR sub-range from mmap is not enough on its own: the region
read/write path still reaches the underlying registers. Refuse an access
that overlaps the excluded range there too, so the only way in is the
provider's trap.

Signed-off-by: Manish Honap <mhonap@xxxxxxxxxx>
---
 drivers/vfio/pci/vfio_pci_rdwr.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
index 7f14dd46de17..2ce18e75a5ae 100644
--- a/drivers/vfio/pci/vfio_pci_rdwr.c
+++ b/drivers/vfio/pci/vfio_pci_rdwr.c
@@ -223,6 +223,10 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_core_device *vdev, char __user *buf,
 
 	count = min(count, (size_t)(end - pos));
 
+	/* An excluded sub-range is reached only through its trap. */
+	if (vfio_pci_bar_is_excluded(vdev, bar, pos, count))
+		return -EINVAL;
+
 	if (bar == PCI_ROM_RESOURCE) {
 		/*
 		 * The ROM can fill less space than the BAR, so we start the
@@ -423,6 +427,10 @@ int vfio_pci_ioeventfd(struct vfio_pci_core_device *vdev, loff_t offset,
 	      pos >= vdev->msix_offset + vdev->msix_size))
 		return -EINVAL;
 
+	/* An excluded sub-range is reached only through its trap. */
+	if (vfio_pci_bar_is_excluded(vdev, bar, pos, count))
+		return -EINVAL;
+
 	if (count == 8)
 		return -EINVAL;
 
-- 
2.25.1