On Thu, May 20, 2021 at 2:28 PM Al Viro [off-list ref] wrote:

On Mon, May 17, 2021 at 05:55:12PM +0800, Xie Yongji wrote:

quoted

+     case VDUSE_IOTLB_GET_FD: {
+             struct vduse_iotlb_entry entry;
+             struct vhost_iotlb_map *map;
+             struct vdpa_map_file *map_file;
+             struct vduse_iova_domain *domain = dev->domain;
+             struct file *f = NULL;
+
+             ret = -EFAULT;
+             if (copy_from_user(&entry, argp, sizeof(entry)))
+                     break;

                        return -EFAULT;
surely?

quoted

+
+             ret = -EINVAL;
+             if (entry.start > entry.last)
+                     break;

... and similar here, etc.

OK.

quoted

+             spin_lock(&domain->iotlb_lock);
+             map = vhost_iotlb_itree_first(domain->iotlb,
+                                           entry.start, entry.last);
+             if (map) {
+                     map_file = (struct vdpa_map_file *)map->opaque;
+                     f = get_file(map_file->file);
+                     entry.offset = map_file->offset;
+                     entry.start = map->start;
+                     entry.last = map->last;
+                     entry.perm = map->perm;
+             }
+             spin_unlock(&domain->iotlb_lock);
+             ret = -EINVAL;
+             if (!f)
+                     break;
+
+             ret = -EFAULT;
+             if (copy_to_user(argp, &entry, sizeof(entry))) {
+                     fput(f);
+                     break;
+             }
+             ret = receive_fd(f, perm_to_file_flags(entry.perm));
+             fput(f);
+             break;

IDGI.  The main difference between receive_fd() and plain old
get_unused_fd_flags() + fd_install() is __receive_sock() call.
Which does nothing whatsoever in case of non-sockets.  Can you
get a socket here?

Actually what I want here is the security_file_receive() hook in receive_fd().

Thanks,
Yongji