From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D2D7047F2E8 for ; Tue, 19 May 2026 11:00:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779188415; cv=none; b=JvVaqggkAzkg6J/X/HoAFPjgftVfbP/Y1QgUx6eRlD8nKw8Z17SVev38SYywb09EbByPR6viBpupunyJJhHmiRHPIgOxYv9e8+vlgXqY3uU0QcImMy+q5dZd5HutbQmzY11pKV4+ONPL65ZeIEk8lsJccRampSBfs3+Uj5dPhYc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779188415; c=relaxed/simple; bh=n5B6+29nvQxZ/wHGFunRXCweF9/I5ooQyav/joDC1Q4=; h=Message-ID:Date:MIME-Version:Subject:To:References:From: In-Reply-To:Content-Type; b=Q1vywbQnCUwkhgmIGWEUGVnZ/jrkuwtpoJCa5BqDVoPVJyb5N0igFViPWDaToLzvx/fLcLMMXEUi1CE3WSeMENxyP8DAQnPOwTUt1AGwdCnB0D1wgu8vwVr3ZIXWk74cM3VXA/b5XmvRTpCQiOA3ec0f5mV9hIgcT47WSNqmMYc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=O9UTC5nE; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=Lqr9PpuP; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="O9UTC5nE"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="Lqr9PpuP" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779188410; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=E/R7pULBaPP9T6iOFYumwv5ZvUtdIBTximZQUVwysfc=; b=O9UTC5nE/tw8cCMyKszOzr8CSSWGaJlzpHD729ZzsOjo7jztr06k+lec72L3GMCvctP60l YRf8rZzzsSww+e8w2Q0r7fgkpJrY+PtPMguAeHQMpoeys62q+U9Y+cTqKclYV+/8vy1nq3 547ku1jP6FAqGoURnxH7eVzr1P6XJAU= Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-231-ELfEOXCTOBGkeSYFzWk_qg-1; Tue, 19 May 2026 07:00:08 -0400 X-MC-Unique: ELfEOXCTOBGkeSYFzWk_qg-1 X-Mimecast-MFC-AGG-ID: ELfEOXCTOBGkeSYFzWk_qg_1779188407 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-45e73a4f1dfso2076581f8f.0 for ; Tue, 19 May 2026 04:00:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1779188407; x=1779793207; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:to:subject:user-agent:mime-version:date:message-id:from :to:cc:subject:date:message-id:reply-to; bh=E/R7pULBaPP9T6iOFYumwv5ZvUtdIBTximZQUVwysfc=; b=Lqr9PpuPjwo3YudVUUXbjouAMXWS+euf1Q5DySZWiYXjCryFE6TpDjrcWtI8rmNXXI DkVrheFtgzD9skCrS7XWwEgFR7QkmzRP1KeZ/EaAf/0XxP363I+gUDbvXXp/Y+PmTl+D tfvDP9jqms+W1rnbY/8Vo0HYJ/HHfJsz7Hs4oDrkd5qIy+jvVFtll/D5PanmoScs4JWM qXabsy3X+SxSEyP4laaRHNtWQtiVL1Owa12taeJfZjh4wUsEkr8OFY3djnjoShA8v+Ry zaFBznKWySCXDeXY7xikvU3VaJO02jQnI0M4NjrC1U1H5d/LQyLS7Vr63R2hQ6inWlM3 XpYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779188407; x=1779793207; h=content-transfer-encoding:in-reply-to:content-language:from :references:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=E/R7pULBaPP9T6iOFYumwv5ZvUtdIBTximZQUVwysfc=; b=BctJQcENtmUzTGXAFQ/Qw9YZ7V42T7NsiBJITvwzeZyRX2Cw4JP0Z2ICJeEZPQ4Rfv CK1i7IRxZhF9dGTyJCTvrcojt3/G0fg3WwbkVl86Szthp2WU81SykPFHAwpXPz1gRUh9 XLhcCtq4PZOW5PRQLkGSSZkTZa/YCoAmFDNygx7RoGNk8xpoaK/BSVd8t/kH7emRC3h+ Whzx+038OVf59ISBMz1h+ZFhhffXhwBSXePjQ59uxT67ePQefsEu9bF3jLC/lKJKQgK5 DpVYJ0VKV8JNAJajtEenLpaHqcsBn6DWVeYfcwelYeIKPQDJDgz6AFUXv2jt/c6Lkcgf WjrQ== X-Forwarded-Encrypted: i=1; AFNElJ//Uatcve909KZZbZJoUirIhg/UtCjyIiYFBkY1uhtHcpgzITJ8yqW36b+skRCh5cFJQ98vhKPcXjVL9lY=@vger.kernel.org X-Gm-Message-State: AOJu0Yz0h8Tzcw3ktIyxWNkb+bOcU3TURaEpWjxQ2CVUdw2WN+a/N6CO lfIe/fqQVF4he+3ZC3Rh8bIv6xlAoqCQH54Dtmq4TvjWWnN+zoCq5Q8LxP8TGODIT9yWPHqVGL1 2eIION9E3WOXe+y14vJgGoZzL4BOJ/hlpK8TWrpHz/uzF5/ITjVUEQrG1bSh0x59FiA== X-Gm-Gg: Acq92OGvwFRqUsnB/SMBvLBvHo7N8uyveUvn18+gNXmYvSOo0Dhde2J03Dgn93XqdY/ g/4nBV2lxlyoQwkpTE0YOu0pxGFgMUQGbmdGnJ5mVHAhj+KZD8B99Ub3ZYiOaISvS2uGiaVZ2sQ gdfmQ0DwtHrjN6V0Sv7fPi7TRihjuk46rbysXHWyCvb4zq7GZpC12wXtZBvRDEbbki6G01Ntq1l afln5gBg5S/CB7XFkKzqA3fzP4t8nffWXAb5R3rhcAopJtb+xiuqd0EnEHvMi+rV7Wi1RWUack+ KcjmWjmDcL5nXaBxFjcfXorWT9RlHmt1hxZ0y7tO0JQ4yiol3VKnk5u8as0D1ZlKqLJ/8dMR4Uw 7NVTJas3AWQ5/f917vFNnlfpJWUwHwk8YMl6MuzEQ0kOECvGeGPbv+mE= X-Received: by 2002:a05:6000:40cc:b0:43f:dd91:b022 with SMTP id ffacd0b85a97d-45e5c5ccb3amr31758305f8f.35.1779188406923; Tue, 19 May 2026 04:00:06 -0700 (PDT) X-Received: by 2002:a05:6000:40cc:b0:43f:dd91:b022 with SMTP id ffacd0b85a97d-45e5c5ccb3amr31758224f8f.35.1779188406402; Tue, 19 May 2026 04:00:06 -0700 (PDT) Received: from [192.168.88.32] ([150.228.25.33]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45d9e768acesm47847795f8f.7.2026.05.19.04.00.04 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 19 May 2026 04:00:05 -0700 (PDT) Message-ID: <8a33f35a-195a-4f1f-9282-85f68399b89f@redhat.com> Date: Tue, 19 May 2026 13:00:04 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net] net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer To: Erni Sri Satya Vennela , kys@microsoft.com, haiyangz@microsoft.com, wei.liu@kernel.org, decui@microsoft.com, longli@microsoft.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, dipayanroy@linux.microsoft.com, horms@kernel.org, kees@kernel.org, shacharr@microsoft.com, stephen@networkplumber.org, linux-hyperv@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org References: <20260514194156.466823-1-ernis@linux.microsoft.com> From: Paolo Abeni Content-Language: en-US In-Reply-To: <20260514194156.466823-1-ernis@linux.microsoft.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 5/14/26 9:41 PM, Erni Sri Satya Vennela wrote: > In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from > DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() > re-reads the same field from the same DMA buffer for test_bit() and > pointer arithmetic. > > DMA-coherent memory is mapped uncacheable on x86 and is shared, > unencrypted, in Confidential VMs (SEV-SNP/TDX), so each load goes > directly to host-visible memory. A H/W can modify the value > between the check and the use, bypassing the bounds validation. Sashiko noted there are more related issues in the nearby code: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260514194156.466823-1-ernis%40linux.microsoft.com you may consider a follow-up. /P