netdev - RE: [PATCH 3/3] xen-netback: handle page straddling in xenvif_set_hash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fb15bcd613f24b9fac2d75a232ef2665@AMSPEX02CL03.citrite.net>
Date:   Mon, 3 Sep 2018 09:28:46 +0000
From:   Paul Durrant <Paul.Durrant@...rix.com>
To:     'Jan Beulich' <JBeulich@...e.com>, Wei Liu <wei.liu2@...rix.com>
CC:     "davem@...emloft.net" <davem@...emloft.net>,
        xen-devel <xen-devel@...ts.xenproject.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH 3/3] xen-netback: handle page straddling in
 xenvif_set_hash_mapping()

> -----Original Message-----
> From: Jan Beulich [mailto:JBeulich@...e.com]
> Sent: 28 August 2018 16:00
> To: Paul Durrant <Paul.Durrant@...rix.com>; Wei Liu <wei.liu2@...rix.com>
> Cc: davem@...emloft.net; xen-devel <xen-devel@...ts.xenproject.org>;
> netdev@...r.kernel.org
> Subject: [PATCH 3/3] xen-netback: handle page straddling in
> xenvif_set_hash_mapping()
> 
> There's no guarantee that the mapping array doesn't cross a page
> boundary. Use a second grant copy operation if necessary.
> 
> Signed-off-by: Jan Beulich <jbeulich@...e.com>

Personally I think it would be cleaner to out-of-line the allocation of the mapping table and ensure it is page aligned but this works so...

Reviewed-by: Paul Durrant <paul.durrant@...rix.com>

> 
> ---
>  drivers/net/xen-netback/hash.c |   25 ++++++++++++++++++-------
>  1 file changed, 18 insertions(+), 7 deletions(-)
> 
> --- 4.19-rc1-xen-netback-set-hash-mapping.orig/drivers/net/xen-
> netback/hash.c
> +++ 4.19-rc1-xen-netback-set-hash-mapping/drivers/net/xen-
> netback/hash.c
> @@ -334,28 +334,39 @@ u32 xenvif_set_hash_mapping(struct xenvi
>  			    u32 off)
>  {
>  	u32 *mapping = vif->hash.mapping[!vif->hash.mapping_sel];
> -	struct gnttab_copy copy_op = {
> +	unsigned int nr = 1;
> +	struct gnttab_copy copy_op[2] = {{
>  		.source.u.ref = gref,
>  		.source.domid = vif->domid,
>  		.dest.domid = DOMID_SELF,
>  		.len = len * sizeof(*mapping),
>  		.flags = GNTCOPY_source_gref
> -	};
> +	}};
> 
>  	if ((off + len < off) || (off + len > vif->hash.size) ||
>  	    len > XEN_PAGE_SIZE / sizeof(*mapping))
>  		return XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
> 
> -	copy_op.dest.u.gmfn = virt_to_gfn(mapping + off);
> -	copy_op.dest.offset = xen_offset_in_page(mapping + off);
> +	copy_op[0].dest.u.gmfn = virt_to_gfn(mapping + off);
> +	copy_op[0].dest.offset = xen_offset_in_page(mapping + off);
> +	if (copy_op[0].dest.offset + copy_op[0].len > XEN_PAGE_SIZE) {
> +		copy_op[1] = copy_op[0];
> +		copy_op[1].source.offset = XEN_PAGE_SIZE -
> copy_op[0].dest.offset;
> +		copy_op[1].dest.u.gmfn = virt_to_gfn(mapping + off + len);
> +		copy_op[1].dest.offset = 0;
> +		copy_op[1].len = copy_op[0].len - copy_op[1].source.offset;
> +		copy_op[0].len = copy_op[1].source.offset;
> +		nr = 2;
> +	}
> 
>  	memcpy(mapping, vif->hash.mapping[vif->hash.mapping_sel],
>  	       vif->hash.size * sizeof(*mapping));
> 
> -	if (copy_op.len != 0) {
> -		gnttab_batch_copy(&copy_op, 1);
> +	if (copy_op[0].len != 0) {
> +		gnttab_batch_copy(copy_op, nr);
> 
> -		if (copy_op.status != GNTST_okay)
> +		if (copy_op[0].status != GNTST_okay ||
> +		    copy_op[nr - 1].status != GNTST_okay)
>  			return
> XEN_NETIF_CTRL_STATUS_INVALID_PARAMETER;
>  	}
> 
> 
> 
>