linux-kernel - Re: [PATCH] IB/mlx5: Convert to use vm_map_pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 27 Aug 2019 01:48:57 +0530
From:   Souptick Joarder <jrdr.linux@...il.com>
To:     Jason Gunthorpe <jgg@...pe.ca>
Cc:     leon@...nel.org, Doug Ledford <dledford@...hat.com>,
        linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org,
        Matthew Wilcox <willy@...radead.org>
Subject: Re: [PATCH] IB/mlx5: Convert to use vm_map_pages_zero()

On Mon, Aug 26, 2019 at 5:50 PM Jason Gunthorpe <jgg@...pe.ca> wrote:
>
> On Mon, Aug 26, 2019 at 01:32:09AM +0530, Souptick Joarder wrote:
> > On Mon, Aug 26, 2019 at 1:13 AM Jason Gunthorpe <jgg@...pe.ca> wrote:
> > >
> > > On Sun, Aug 25, 2019 at 11:37:27AM +0530, Souptick Joarder wrote:
> > > > First, length passed to mmap is checked explicitly against
> > > > PAGE_SIZE.
> > > >
> > > > Second, if vma->vm_pgoff is passed as non zero, it would return
> > > > error. It appears like driver is expecting vma->vm_pgoff to
> > > > be passed as 0 always.
> > >
> > > ? pg_off is not zero
> >
> > Sorry, I mean, driver has a check against non zero to return error -EOPNOTSUPP
> > which means in true scenario driver is expecting vma->vm_pgoff should be passed
> > as 0.
>
> get_index is masking vm_pgoff, it is not 0

Sorry, I missed this part. Further looking into code,
in mlx5_ib_mmap(), vma_vm_pgoff is used to get command and
inside mlx5_ib_mmap_clock_info_page() entire *dev->mdev->clock_info*
is mapped.

Consider that, the below modification will only take care of vma length
error check inside vm_map_pages_zero() and an extra check for vma
length is not needed.

diff --git a/drivers/infiniband/hw/mlx5/main.c
b/drivers/infiniband/hw/mlx5/main.c
index 0569bca..c3e3bfe 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -2071,8 +2071,9 @@ static int mlx5_ib_mmap_clock_info_page(struct
mlx5_ib_dev *dev,
                                        struct vm_area_struct *vma,
                                        struct mlx5_ib_ucontext *context)
 {
-       if ((vma->vm_end - vma->vm_start != PAGE_SIZE) ||
-           !(vma->vm_flags & VM_SHARED))
+       struct page *pages;
+
+       if (!(vma->vm_flags & VM_SHARED))
                return -EINVAL;

        if (get_index(vma->vm_pgoff) != MLX5_IB_CLOCK_INFO_V1)
@@ -2084,9 +2085,9 @@ static int mlx5_ib_mmap_clock_info_page(struct
mlx5_ib_dev *dev,

        if (!dev->mdev->clock_info)
                return -EOPNOTSUPP;
+       pages = virt_to_page(dev->mdev->clock_info);

-       return vm_insert_page(vma, vma->vm_start,
-                             virt_to_page(dev->mdev->clock_info));
+       return vm_map_pages_zero(vma, &pages, 1);
 }

If this is fine, I can post it as v2. Otherwise I will drop this patch ?