From mboxrd@z Thu Jan 1 00:00:00 1970 From: Khalid Aziz Subject: Re: [PATCH v17 12/15] media/v4l2-core, arm64: untag user pointers in videobuf_dma_contig_user_get Date: Wed, 19 Jun 2019 14:05:20 -0600 Message-ID: <5ea75db0-20e9-7423-8670-967eedd56440@oracle.com> References: <7fbcdbe16a2bd99e92eb4541248469738d89a122.1560339705.git.andreyknvl@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <7fbcdbe16a2bd99e92eb4541248469738d89a122.1560339705.git.andreyknvl@google.com> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=m.gmane.org@lists.infradead.org To: Andrey Konovalov , linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-rdma@vger.kernel.org, linux-media@vger.kernel.org, kvm@vger.kernel.org, linux-kselftest@vger.kernel.org Cc: Mark Rutland , Szabolcs Nagy , Catalin Marinas , Will Deacon , Kostya Serebryany , Mauro Carvalho Chehab , Felix Kuehling , Vincenzo Frascino , Jacob Bramley , Leon Romanovsky , Christoph Hellwig , Jason Gunthorpe , Dave Martin , Evgeniy Stepanov , Kevin Brodsky , Kees Cook , Ruben Ayrapetyan , Ramana Radhakrishnan , Alex Williamson , Mauro Carvalho Chehab , Dmitry Vyukov , Greg Kroah-Hartman List-Id: linux-rdma@vger.kernel.org On 6/12/19 5:43 AM, Andrey Konovalov wrote: > This patch is a part of a series that extends arm64 kernel ABI to allow to > pass tagged user pointers (with the top byte set to something else other > than 0x00) as syscall arguments. > > videobuf_dma_contig_user_get() uses provided user pointers for vma > lookups, which can only by done with untagged pointers. > > Untag the pointers in this function. > > Reviewed-by: Kees Cook > Acked-by: Mauro Carvalho Chehab > Signed-off-by: Andrey Konovalov > --- Patch looks good, but commit log should be updated to not be specific to arm64. Reviewed-by: Khalid Aziz > drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > exact_copy_from_user > diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c > index e1bf50df4c70..8a1ddd146b17 100644 > --- a/drivers/media/v4l2-core/videobuf-dma-contig.c > +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c > @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem) > static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, > struct videobuf_buffer *vb) > { > + unsigned long untagged_baddr = untagged_addr(vb->baddr); > struct mm_struct *mm = current->mm; > struct vm_area_struct *vma; > unsigned long prev_pfn, this_pfn; > @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, > unsigned int offset; > int ret; > > - offset = vb->baddr & ~PAGE_MASK; > + offset = untagged_baddr & ~PAGE_MASK; > mem->size = PAGE_ALIGN(vb->size + offset); > ret = -EINVAL; > > down_read(&mm->mmap_sem); > > - vma = find_vma(mm, vb->baddr); > + vma = find_vma(mm, untagged_baddr); > if (!vma) > goto out_up; > > - if ((vb->baddr + mem->size) > vma->vm_end) > + if ((untagged_baddr + mem->size) > vma->vm_end) > goto out_up; > > pages_done = 0; > prev_pfn = 0; /* kill warning */ > - user_address = vb->baddr; > + user_address = untagged_baddr; > > while (pages_done < (mem->size >> PAGE_SHIFT)) { > ret = follow_pfn(vma, user_address, &this_pfn); >