Unverified Commit f831558e authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13109 RDMA/hns: Fix DCA mmap area PUAF 

Merge Pull Request from: @ci-robot 
 
PR sync from: Chengchang Tang <tangchengchang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZQ7S35TCDFJ2VGACSDHEZ7KQS6K37JB5/ 
 
https://gitee.com/openeuler/kernel/issues/IB2H4P 
 
Link:https://gitee.com/openeuler/kernel/pulls/13109

 

Reviewed-by: default avatarChengchang Tang <tangchengchang@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 3f9cdf70 13d73fd9

drivers/infiniband/hw/hns/hns_roce_dca.c

+2 −1
Original line number Diff line number Diff line
@@ -1132,7 +1132,8 @@ static void init_udca_status(struct hns_roce_ucontext *uctx, int udca_max_qps, 
		return;



	ctx->dca_mmap_entry = hns_roce_user_mmap_entry_insert(ib_uctx,

				(u64)kaddr, size, HNS_ROCE_MMAP_TYPE_DCA);

				(u64)virt_to_phys(kaddr), size,

				HNS_ROCE_MMAP_TYPE_DCA);

	if (!ctx->dca_mmap_entry) {

		free_pages_exact(kaddr, size);

		return;

drivers/infiniband/hw/hns/hns_roce_main.c

+7 −32
Original line number Diff line number Diff line
@@ -644,36 +644,6 @@ static void hns_roce_dealloc_ucontext(struct ib_ucontext *ibcontext) 
	ida_free(&hr_dev->uar_ida.ida, (int)context->uar.logic_idx);

}



static int mmap_dca(struct ib_ucontext *context, struct vm_area_struct *vma)

{

	struct hns_roce_ucontext *uctx = to_hr_ucontext(context);

	struct hns_roce_dca_ctx *ctx = &uctx->dca_ctx;

	struct page **pages;

	unsigned long num;

	int ret;



	if ((vma->vm_end - vma->vm_start != (ctx->status_npage * PAGE_SIZE) ||

	     !(vma->vm_flags & VM_SHARED)))

		return -EINVAL;



	if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC))

		return -EPERM;



	if (!ctx->buf_status)

		return -EOPNOTSUPP;



	pages = kcalloc(ctx->status_npage, sizeof(struct page *), GFP_KERNEL);

	if (!pages)

		return -ENOMEM;



	for (num = 0; num < ctx->status_npage; num++)

		pages[num] = virt_to_page(ctx->buf_status + num * PAGE_SIZE);



	ret = vm_insert_pages(vma, vma->vm_start, pages, &num);

	kfree(pages);

	return ret;

}



static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma)

{

	struct hns_roce_dev *hr_dev = to_hr_dev(uctx->device);
@@ -703,8 +673,13 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) 
		prot = pgprot_device(vma->vm_page_prot);

		break;

	case HNS_ROCE_MMAP_TYPE_DCA:

		ret = mmap_dca(uctx, vma);

		if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) {

			ret = -EPERM;

			goto out;

		}

		vm_flags_set(vma, VM_DONTEXPAND);

		prot = vma->vm_page_prot;

		break;

	case HNS_ROCE_MMAP_TYPE_RESET:

		if (vma->vm_flags & (VM_WRITE | VM_EXEC)) {

			ret = -EINVAL;