| Message ID | 20181217202209.GA8859@jordon-HP-15-Notebook-PC (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Use vm_insert_range | expand |
On Tue, Dec 18, 2018 at 01:52:09AM +0530, Souptick Joarder wrote: > Convert to use vm_insert_range() to map range of kernel > memory to user vma. > > Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com> > --- > arch/arm/mm/dma-mapping.c | 21 +++++++-------------- > 1 file changed, 7 insertions(+), 14 deletions(-) > > diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c > index 661fe48..7cbcde5 100644 > --- a/arch/arm/mm/dma-mapping.c > +++ b/arch/arm/mm/dma-mapping.c > @@ -1582,31 +1582,24 @@ static int __arm_iommu_mmap_attrs(struct device *dev, struct vm_area_struct *vma > void *cpu_addr, dma_addr_t dma_addr, size_t size, > unsigned long attrs) > { > - unsigned long uaddr = vma->vm_start; > - unsigned long usize = vma->vm_end - vma->vm_start; > + unsigned long page_count = vma_pages(vma); > struct page **pages = __iommu_get_pages(cpu_addr, attrs); > unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT; > unsigned long off = vma->vm_pgoff; > + int err; > > if (!pages) > return -ENXIO; > > - if (off >= nr_pages || (usize >> PAGE_SHIFT) > nr_pages - off) > + if (off >= nr_pages) > return -ENXIO; Are you sure you can make this change? You are restricting the offset to be within 0..nr_pages which ensures that the initial struct page that is passed to vm_insert_range() is valid, but I think the removal of the following check is unsafe. Your new vm_insert_range() function only checks page_count <= vma_pages(vma), which it will be since it _is_ vma_pages(vma). With the removal of the second condition, there will be nothing checking that (eg) off may be nr_pages - 1, and page_count=50, meaning that vm_insert_range() will walk off the end of the page array. Please take another look at this. What about the other callsites of your new function - do they have the same issue?
On Tue, Dec 18, 2018 at 3:08 PM Russell King - ARM Linux <linux@armlinux.org.uk> wrote: > > On Tue, Dec 18, 2018 at 01:52:09AM +0530, Souptick Joarder wrote: > > Convert to use vm_insert_range() to map range of kernel > > memory to user vma. > > > > Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com> > > --- > > arch/arm/mm/dma-mapping.c | 21 +++++++-------------- > > 1 file changed, 7 insertions(+), 14 deletions(-) > > > > diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c > > index 661fe48..7cbcde5 100644 > > --- a/arch/arm/mm/dma-mapping.c > > +++ b/arch/arm/mm/dma-mapping.c > > @@ -1582,31 +1582,24 @@ static int __arm_iommu_mmap_attrs(struct device *dev, struct vm_area_struct *vma > > void *cpu_addr, dma_addr_t dma_addr, size_t size, > > unsigned long attrs) > > { > > - unsigned long uaddr = vma->vm_start; > > - unsigned long usize = vma->vm_end - vma->vm_start; > > + unsigned long page_count = vma_pages(vma); > > struct page **pages = __iommu_get_pages(cpu_addr, attrs); > > unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT; > > unsigned long off = vma->vm_pgoff; > > + int err; > > > > if (!pages) > > return -ENXIO; > > > > - if (off >= nr_pages || (usize >> PAGE_SHIFT) > nr_pages - off) > > + if (off >= nr_pages) > > return -ENXIO; > > Are you sure you can make this change? > > You are restricting the offset to be within 0..nr_pages which ensures > that the initial struct page that is passed to vm_insert_range() is > valid, but I think the removal of the following check is unsafe. > > Your new vm_insert_range() function only checks page_count <= > vma_pages(vma), which it will be since it _is_ vma_pages(vma). With > the removal of the second condition, there will be nothing checking > that (eg) off may be nr_pages - 1, and page_count=50, meaning that > vm_insert_range() will walk off the end of the page array. > > Please take another look at this. This check shouldn't be removed. > > What about the other callsites of your new function - do they have > the same issue? I think other callsites don't have the same issue. > > -- > RMK's Patch system: http://www.armlinux.org.uk/developer/patches/ > FTTC broadband for 0.8mile line in suburbia: sync at 12.1Mbps down 622kbps up > According to speedtest.net: 11.9Mbps down 500kbps up
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c index 661fe48..7cbcde5 100644 --- a/arch/arm/mm/dma-mapping.c +++ b/arch/arm/mm/dma-mapping.c @@ -1582,31 +1582,24 @@ static int __arm_iommu_mmap_attrs(struct device *dev, struct vm_area_struct *vma void *cpu_addr, dma_addr_t dma_addr, size_t size, unsigned long attrs) { - unsigned long uaddr = vma->vm_start; - unsigned long usize = vma->vm_end - vma->vm_start; + unsigned long page_count = vma_pages(vma); struct page **pages = __iommu_get_pages(cpu_addr, attrs); unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT; unsigned long off = vma->vm_pgoff; + int err; if (!pages) return -ENXIO; - if (off >= nr_pages || (usize >> PAGE_SHIFT) > nr_pages - off) + if (off >= nr_pages) return -ENXIO; pages += off; + err = vm_insert_range(vma, vma->vm_start, pages, page_count); + if (err) + pr_err("Remapping memory failed: %d\n", err); - do { - int ret = vm_insert_page(vma, uaddr, *pages++); - if (ret) { - pr_err("Remapping memory failed: %d\n", ret); - return ret; - } - uaddr += PAGE_SIZE; - usize -= PAGE_SIZE; - } while (usize > 0); - - return 0; + return err; } static int arm_iommu_mmap_attrs(struct device *dev, struct vm_area_struct *vma, void *cpu_addr,
Convert to use vm_insert_range() to map range of kernel memory to user vma. Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com> --- arch/arm/mm/dma-mapping.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)