lkml.org 
[lkml]   [2019]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    Subject[PATCH v18 08/15] userfaultfd: untag user pointers
    From
    This patch is a part of a series that extends kernel ABI to allow to pass
    tagged user pointers (with the top byte set to something else other than
    0x00) as syscall arguments.

    userfaultfd code use provided user pointers for vma lookups, which can
    only by done with untagged pointers.

    Untag user pointers in validate_range().

    Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
    Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
    ---
    fs/userfaultfd.c | 22 ++++++++++++----------
    1 file changed, 12 insertions(+), 10 deletions(-)

    diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
    index ae0b8b5f69e6..c2be36a168ca 100644
    --- a/fs/userfaultfd.c
    +++ b/fs/userfaultfd.c
    @@ -1261,21 +1261,23 @@ static __always_inline void wake_userfault(struct userfaultfd_ctx *ctx,
    }

    static __always_inline int validate_range(struct mm_struct *mm,
    - __u64 start, __u64 len)
    + __u64 *start, __u64 len)
    {
    __u64 task_size = mm->task_size;

    - if (start & ~PAGE_MASK)
    + *start = untagged_addr(*start);
    +
    + if (*start & ~PAGE_MASK)
    return -EINVAL;
    if (len & ~PAGE_MASK)
    return -EINVAL;
    if (!len)
    return -EINVAL;
    - if (start < mmap_min_addr)
    + if (*start < mmap_min_addr)
    return -EINVAL;
    - if (start >= task_size)
    + if (*start >= task_size)
    return -EINVAL;
    - if (len > task_size - start)
    + if (len > task_size - *start)
    return -EINVAL;
    return 0;
    }
    @@ -1325,7 +1327,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
    goto out;
    }

    - ret = validate_range(mm, uffdio_register.range.start,
    + ret = validate_range(mm, &uffdio_register.range.start,
    uffdio_register.range.len);
    if (ret)
    goto out;
    @@ -1514,7 +1516,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
    if (copy_from_user(&uffdio_unregister, buf, sizeof(uffdio_unregister)))
    goto out;

    - ret = validate_range(mm, uffdio_unregister.start,
    + ret = validate_range(mm, &uffdio_unregister.start,
    uffdio_unregister.len);
    if (ret)
    goto out;
    @@ -1665,7 +1667,7 @@ static int userfaultfd_wake(struct userfaultfd_ctx *ctx,
    if (copy_from_user(&uffdio_wake, buf, sizeof(uffdio_wake)))
    goto out;

    - ret = validate_range(ctx->mm, uffdio_wake.start, uffdio_wake.len);
    + ret = validate_range(ctx->mm, &uffdio_wake.start, uffdio_wake.len);
    if (ret)
    goto out;

    @@ -1705,7 +1707,7 @@ static int userfaultfd_copy(struct userfaultfd_ctx *ctx,
    sizeof(uffdio_copy)-sizeof(__s64)))
    goto out;

    - ret = validate_range(ctx->mm, uffdio_copy.dst, uffdio_copy.len);
    + ret = validate_range(ctx->mm, &uffdio_copy.dst, uffdio_copy.len);
    if (ret)
    goto out;
    /*
    @@ -1761,7 +1763,7 @@ static int userfaultfd_zeropage(struct userfaultfd_ctx *ctx,
    sizeof(uffdio_zeropage)-sizeof(__s64)))
    goto out;

    - ret = validate_range(ctx->mm, uffdio_zeropage.range.start,
    + ret = validate_range(ctx->mm, &uffdio_zeropage.range.start,
    uffdio_zeropage.range.len);
    if (ret)
    goto out;
    --
    2.22.0.410.gd8fdbe21b5-goog
    \
     
     \ /
      Last update: 2019-06-24 16:34    [W:4.140 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site