netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Saeed Mahameed <saeedm@mellanox.com>
To: "David S. Miller" <davem@davemloft.net>,
	Doug Ledford <dledford@redhat.com>
Cc: netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
	Leon Romanovsky <leonro@mellanox.com>,
	Eli Cohen <eli@mellanox.com>, Matan Barak <matanb@mellanox.com>,
	Leon Romanovsky <leon@kernel.org>,
	Saeed Mahameed <saeedm@mellanox.com>
Subject: [for-next V3 01/10] IB/mlx5: Fix kernel to user leak prevention logic
Date: Mon,  9 Jan 2017 21:00:44 +0200	[thread overview]
Message-ID: <1483988453-28551-2-git-send-email-saeedm@mellanox.com> (raw)
In-Reply-To: <1483988453-28551-1-git-send-email-saeedm@mellanox.com>

From: Eli Cohen <eli@mellanox.com>

The logic was broken as it failed to update the response length for
architectures with PAGE_SIZE larger than 4kB. As a result further
extension of the ucontext response struct would fail.

Fixes: d69e3bcf7976 ('IB/mlx5: Mmap the HCA's core clock register to user-space')
Signed-off-by: Eli Cohen <eli@mellanox.com>
Reviewed-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
---
 drivers/infiniband/hw/mlx5/main.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 86c61e7..852b5b7 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1148,13 +1148,13 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev,
 	 * pretend we don't support reading the HCA's core clock. This is also
 	 * forced by mmap function.
 	 */
-	if (PAGE_SIZE <= 4096 &&
-	    field_avail(typeof(resp), hca_core_clock_offset, udata->outlen)) {
-		resp.comp_mask |=
-			MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_CORE_CLOCK_OFFSET;
-		resp.hca_core_clock_offset =
-			offsetof(struct mlx5_init_seg, internal_timer_h) %
-			PAGE_SIZE;
+	if (field_avail(typeof(resp), hca_core_clock_offset, udata->outlen)) {
+		if (PAGE_SIZE <= 4096) {
+			resp.comp_mask |=
+				MLX5_IB_ALLOC_UCONTEXT_RESP_MASK_CORE_CLOCK_OFFSET;
+			resp.hca_core_clock_offset =
+				offsetof(struct mlx5_init_seg, internal_timer_h) % PAGE_SIZE;
+		}
 		resp.response_length += sizeof(resp.hca_core_clock_offset) +
 					sizeof(resp.reserved2);
 	}
-- 
2.7.4

  reply	other threads:[~2017-01-09 19:01 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-01-09 19:00 [for-next V3 00/10][pull request] Mellanox 100G mlx5 4K UAR support Saeed Mahameed
2017-01-09 19:00 ` Saeed Mahameed [this message]
2017-01-09 19:00 ` [for-next V3 02/10] IB/mlx5: Fix error handling order in create_kernel_qp Saeed Mahameed
2017-01-09 19:00 ` [for-next V3 04/10] IB/mlx5: Fix retrieval of index to first hi class bfreg Saeed Mahameed
2017-01-09 19:00 ` [for-next V3 05/10] net/mlx5: Introduce blue flame register allocator Saeed Mahameed
2017-01-09 19:00 ` [for-next V3 06/10] net/mlx5: Add interface to get reference to a UAR Saeed Mahameed
     [not found] ` <1483988453-28551-1-git-send-email-saeedm-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
2017-01-09 19:00   ` [for-next V3 03/10] mlx5: Fix naming convention with respect to UARs Saeed Mahameed
2017-01-09 19:00   ` [for-next V3 07/10] IB/mlx5: Use blue flame register allocator in mlx5_ib Saeed Mahameed
2017-01-09 19:00   ` [for-next V3 08/10] IB/mlx5: Allow future extension of libmlx5 input data Saeed Mahameed
2017-01-09 19:00   ` [for-next V3 09/10] IB/mlx5: Support 4k UAR for libmlx5 Saeed Mahameed
2017-01-10  4:53   ` [for-next V3 00/10][pull request] Mellanox 100G mlx5 4K UAR support Doug Ledford
     [not found]     ` <1484024006.2149.11.camel-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2017-01-10  6:50       ` Leon Romanovsky
2017-01-09 19:00 ` [for-next V3 10/10] net/mlx5: Activate support for 4K UARs Saeed Mahameed
2017-01-09 22:16 ` [for-next V3 00/10][pull request] Mellanox 100G mlx5 4K UAR support David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1483988453-28551-2-git-send-email-saeedm@mellanox.com \
    --to=saeedm@mellanox.com \
    --cc=davem@davemloft.net \
    --cc=dledford@redhat.com \
    --cc=eli@mellanox.com \
    --cc=leon@kernel.org \
    --cc=leonro@mellanox.com \
    --cc=linux-rdma@vger.kernel.org \
    --cc=matanb@mellanox.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).