Re: [PATCH v18 11/15] IB/mlx4: untag user pointers in mlx4_get_umem_mr

On Mon, Jun 24, 2019 at 04:32:56PM +0200, Andrey Konovalov wrote:

This patch is a part of a series that extends kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.

mlx4_get_umem_mr() uses provided user pointers for vma lookups, which can only by done with untagged pointers.

Untag user pointers in this function.

Signed-off-by: Andrey Konovalov andreyknvl@google.com

Reviewed-by: Kees Cook keescook@chromium.org

-Kees

---

drivers/infiniband/hw/mlx4/mr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c index 355205a28544..13d9f917f249 100644 --- a/drivers/infiniband/hw/mlx4/mr.c +++ b/drivers/infiniband/hw/mlx4/mr.c @@ -378,6 +378,7 @@ static struct ib_umem *mlx4_get_umem_mr(struct ib_udata *udata, u64 start, * again */ if (!ib_access_writable(access_flags)) {

• unsigned long untagged_start = untagged_addr(start);
  

  struct vm_area_struct *vma;

down_read(&current->mm->mmap_sem); @@ -386,9 +387,9 @@ static struct ib_umem *mlx4_get_umem_mr(struct ib_udata *udata, u64 start, * cover the memory, but for now it requires a single vma to * entirely cover the MR to support RO mappings. */

• vma = find_vma(current->mm, start);
  

• if (vma && vma->vm_end >= start + length &&
  

•     vma->vm_start <= start) {
  

• vma = find_vma(current->mm, untagged_start);
  

• if (vma && vma->vm_end >= untagged_start + length &&
  

•     vma->vm_start <= untagged_start) {
  if (vma->vm_flags & VM_WRITE)
  	access_flags |= IB_ACCESS_LOCAL_WRITE;
  

  } else {

-- 2.22.0.410.gd8fdbe21b5-goog