| Message ID | ae6961bcdd82e529c76d0747abd310546f81e58e.1553093421.git.andreyknvl@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | arm64: untag user pointers passed to the kernel | expand |
On Wed, Mar 20, 2019 at 03:51:31PM +0100, Andrey Konovalov wrote: > This patch is a part of a series that extends arm64 kernel ABI to allow to > pass tagged user pointers (with the top byte set to something else other > than 0x00) as syscall arguments. > > videobuf_dma_contig_user_get() uses provided user pointers for vma > lookups, which can only by done with untagged pointers. > > Untag the pointers in this function. > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > --- > drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c > index e1bf50df4c70..8a1ddd146b17 100644 > --- a/drivers/media/v4l2-core/videobuf-dma-contig.c > +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c > @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem) > static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, > struct videobuf_buffer *vb) > { > + unsigned long untagged_baddr = untagged_addr(vb->baddr); > struct mm_struct *mm = current->mm; > struct vm_area_struct *vma; > unsigned long prev_pfn, this_pfn; > @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, > unsigned int offset; > int ret; > > - offset = vb->baddr & ~PAGE_MASK; > + offset = untagged_baddr & ~PAGE_MASK; > mem->size = PAGE_ALIGN(vb->size + offset); > ret = -EINVAL; > > down_read(&mm->mmap_sem); > > - vma = find_vma(mm, vb->baddr); > + vma = find_vma(mm, untagged_baddr); > if (!vma) > goto out_up; > > - if ((vb->baddr + mem->size) > vma->vm_end) > + if ((untagged_baddr + mem->size) > vma->vm_end) > goto out_up; > > pages_done = 0; > prev_pfn = 0; /* kill warning */ > - user_address = vb->baddr; > + user_address = untagged_baddr; > > while (pages_done < (mem->size >> PAGE_SHIFT)) { > ret = follow_pfn(vma, user_address, &this_pfn); I don't think vb->baddr here is anonymous mmap() but worth checking the call paths.
On 22/03/2019 16:07, Catalin Marinas wrote: > On Wed, Mar 20, 2019 at 03:51:31PM +0100, Andrey Konovalov wrote: >> This patch is a part of a series that extends arm64 kernel ABI to allow to >> pass tagged user pointers (with the top byte set to something else other >> than 0x00) as syscall arguments. >> >> videobuf_dma_contig_user_get() uses provided user pointers for vma >> lookups, which can only by done with untagged pointers. >> >> Untag the pointers in this function. >> >> Signed-off-by: Andrey Konovalov <andreyknvl@google.com> >> --- >> drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++---- >> 1 file changed, 5 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c >> index e1bf50df4c70..8a1ddd146b17 100644 >> --- a/drivers/media/v4l2-core/videobuf-dma-contig.c >> +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c >> @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem) >> static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, >> struct videobuf_buffer *vb) >> { >> + unsigned long untagged_baddr = untagged_addr(vb->baddr); >> struct mm_struct *mm = current->mm; >> struct vm_area_struct *vma; >> unsigned long prev_pfn, this_pfn; >> @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, >> unsigned int offset; >> int ret; >> >> - offset = vb->baddr & ~PAGE_MASK; >> + offset = untagged_baddr & ~PAGE_MASK; >> mem->size = PAGE_ALIGN(vb->size + offset); >> ret = -EINVAL; >> >> down_read(&mm->mmap_sem); >> >> - vma = find_vma(mm, vb->baddr); >> + vma = find_vma(mm, untagged_baddr); >> if (!vma) >> goto out_up; >> >> - if ((vb->baddr + mem->size) > vma->vm_end) >> + if ((untagged_baddr + mem->size) > vma->vm_end) >> goto out_up; >> >> pages_done = 0; >> prev_pfn = 0; /* kill warning */ >> - user_address = vb->baddr; >> + user_address = untagged_baddr; >> >> while (pages_done < (mem->size >> PAGE_SHIFT)) { >> ret = follow_pfn(vma, user_address, &this_pfn); > I don't think vb->baddr here is anonymous mmap() but worth checking the > call paths. I spent some time on this, I didn't find any restriction on the kind of mapping that's allowed here. The API regarding V4L2_MEMORY_USERPTR doesn't seem to say anything about that either [0] [1]. It's probably best to ask the V4L2 maintainers. Kevin [0] https://www.kernel.org/doc/html/latest/media/uapi/v4l/vidioc-qbuf.html [1] https://www.kernel.org/doc/html/latest/media/uapi/v4l/userp.html
On Mon, Mar 25, 2019 at 3:08 PM Kevin Brodsky <kevin.brodsky@arm.com> wrote: > > On 22/03/2019 16:07, Catalin Marinas wrote: > > On Wed, Mar 20, 2019 at 03:51:31PM +0100, Andrey Konovalov wrote: > >> This patch is a part of a series that extends arm64 kernel ABI to allow to > >> pass tagged user pointers (with the top byte set to something else other > >> than 0x00) as syscall arguments. > >> > >> videobuf_dma_contig_user_get() uses provided user pointers for vma > >> lookups, which can only by done with untagged pointers. > >> > >> Untag the pointers in this function. > >> > >> Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > >> --- > >> drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++---- > >> 1 file changed, 5 insertions(+), 4 deletions(-) > >> > >> diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c > >> index e1bf50df4c70..8a1ddd146b17 100644 > >> --- a/drivers/media/v4l2-core/videobuf-dma-contig.c > >> +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c > >> @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem) > >> static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, > >> struct videobuf_buffer *vb) > >> { > >> + unsigned long untagged_baddr = untagged_addr(vb->baddr); > >> struct mm_struct *mm = current->mm; > >> struct vm_area_struct *vma; > >> unsigned long prev_pfn, this_pfn; > >> @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, > >> unsigned int offset; > >> int ret; > >> > >> - offset = vb->baddr & ~PAGE_MASK; > >> + offset = untagged_baddr & ~PAGE_MASK; > >> mem->size = PAGE_ALIGN(vb->size + offset); > >> ret = -EINVAL; > >> > >> down_read(&mm->mmap_sem); > >> > >> - vma = find_vma(mm, vb->baddr); > >> + vma = find_vma(mm, untagged_baddr); > >> if (!vma) > >> goto out_up; > >> > >> - if ((vb->baddr + mem->size) > vma->vm_end) > >> + if ((untagged_baddr + mem->size) > vma->vm_end) > >> goto out_up; > >> > >> pages_done = 0; > >> prev_pfn = 0; /* kill warning */ > >> - user_address = vb->baddr; > >> + user_address = untagged_baddr; > >> > >> while (pages_done < (mem->size >> PAGE_SHIFT)) { > >> ret = follow_pfn(vma, user_address, &this_pfn); > > I don't think vb->baddr here is anonymous mmap() but worth checking the > > call paths. The call path is __videobuf_iolock()->videobuf_dma_contig_user_get()->find_vma(). > > I spent some time on this, I didn't find any restriction on the kind of mapping > that's allowed here. The API regarding V4L2_MEMORY_USERPTR doesn't seem to say > anything about that either [0] [1]. It's probably best to ask the V4L2 maintainers. Mauro, could you comment on whether the vb->baddr argument for the V4L2_MEMORY_USERPTR API can come from an anonymous memory mapping? > > Kevin > > [0] https://www.kernel.org/doc/html/latest/media/uapi/v4l/vidioc-qbuf.html > [1] https://www.kernel.org/doc/html/latest/media/uapi/v4l/userp.html
diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c index e1bf50df4c70..8a1ddd146b17 100644 --- a/drivers/media/v4l2-core/videobuf-dma-contig.c +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c @@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem) static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, struct videobuf_buffer *vb) { + unsigned long untagged_baddr = untagged_addr(vb->baddr); struct mm_struct *mm = current->mm; struct vm_area_struct *vma; unsigned long prev_pfn, this_pfn; @@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, unsigned int offset; int ret; - offset = vb->baddr & ~PAGE_MASK; + offset = untagged_baddr & ~PAGE_MASK; mem->size = PAGE_ALIGN(vb->size + offset); ret = -EINVAL; down_read(&mm->mmap_sem); - vma = find_vma(mm, vb->baddr); + vma = find_vma(mm, untagged_baddr); if (!vma) goto out_up; - if ((vb->baddr + mem->size) > vma->vm_end) + if ((untagged_baddr + mem->size) > vma->vm_end) goto out_up; pages_done = 0; prev_pfn = 0; /* kill warning */ - user_address = vb->baddr; + user_address = untagged_baddr; while (pages_done < (mem->size >> PAGE_SHIFT)) { ret = follow_pfn(vma, user_address, &this_pfn);
This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments. videobuf_dma_contig_user_get() uses provided user pointers for vma lookups, which can only by done with untagged pointers. Untag the pointers in this function. Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)