Fix illegal access in IOMMU debugfs

[PATCH 0/2] Fix illegal access in IOMMU debugfs

Posted by Guanghui Feng 2 weeks, 4 days ago

In AMD IOMMU debugfs,
1. set the device, address, and other information to be accessed
2. After verifying the legitimacy of the device, address, and other
information in step 1, access and obtain the information

However, before actually accessing the device, invalid device or address
information might be set again after the legitimacy verification in step
2, thus triggering an unauthorized access issue.

Guanghui Feng (2):
  iommu/amd: Fix illegal device-id access in IOMMU debugfs
  iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs

 drivers/iommu/amd/debugfs.c | 63 ++++++++++++++++++-------------------
 1 file changed, 31 insertions(+), 32 deletions(-)

-- 
2.43.7

Re: [PATCH 0/2] Fix illegal access in IOMMU debugfs

Posted by Jörg Rödel 1 week, 3 days ago

On Thu, Mar 19, 2026 at 03:37:52PM +0800, Guanghui Feng wrote:
> In AMD IOMMU debugfs,
> 1. set the device, address, and other information to be accessed
> 2. After verifying the legitimacy of the device, address, and other
> information in step 1, access and obtain the information
> 
> However, before actually accessing the device, invalid device or address
> information might be set again after the legitimacy verification in step
> 2, thus triggering an unauthorized access issue.
> 
> Guanghui Feng (2):
>   iommu/amd: Fix illegal device-id access in IOMMU debugfs
>   iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
> 
>  drivers/iommu/amd/debugfs.c | 63 ++++++++++++++++++-------------------
>  1 file changed, 31 insertions(+), 32 deletions(-)

Applied, thanks.

Vasant, this patch-set fixes pretty serious issues. Can you please further
review the AMD IOMMU debugfs code to make it more robust and secure?

-Joerg

Re: [PATCH 0/2] Fix illegal access in IOMMU debugfs

Posted by guanghuifeng@linux.alibaba.com 5 days, 23 hours ago

I am very willing to participate in the upstream community feature review.

Thanks.


在 2026/3/27 16:29, Jörg Rödel 写道:
> On Thu, Mar 19, 2026 at 03:37:52PM +0800, Guanghui Feng wrote:
>> In AMD IOMMU debugfs,
>> 1. set the device, address, and other information to be accessed
>> 2. After verifying the legitimacy of the device, address, and other
>> information in step 1, access and obtain the information
>>
>> However, before actually accessing the device, invalid device or address
>> information might be set again after the legitimacy verification in step
>> 2, thus triggering an unauthorized access issue.
>>
>> Guanghui Feng (2):
>>    iommu/amd: Fix illegal device-id access in IOMMU debugfs
>>    iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
>>
>>   drivers/iommu/amd/debugfs.c | 63 ++++++++++++++++++-------------------
>>   1 file changed, 31 insertions(+), 32 deletions(-)
> Applied, thanks.
>
> Vasant, this patch-set fixes pretty serious issues. Can you please further
> review the AMD IOMMU debugfs code to make it more robust and secure?
>
> -Joerg