Subject: Re: [PATCH 12 of 20] ipath - misc driver support code
From: Arjan van de Ven <arjan@infradead.org>
To: "Bryan O'Sullivan" <bos@pathscale.com>
Cc: linux-kernel@vger.kernel.org, openib-general@openib.org
In-Reply-To: <5e9b0b7876e2d570f25e.1135816291@eng-12.pathscale.com>
References: <5e9b0b7876e2d570f25e.1135816291@eng-12.pathscale.com>
Content-Type: text/plain
Date: Fri, 30 Dec 2005 19:15:47 +0100
Message-Id: <1135966547.2941.30.camel@laptopd505.fenrus.org>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1341
Lines: 39

> +int ipath_get_upages_nocopy(unsigned long start_page, struct page **p)
> +{
> +	int n;
> +	struct vm_area_struct *vm = NULL;
> +
> +	down_read(&current->mm->mmap_sem);
> +	n = get_user_pages(current, current->mm, start_page, 1, 1, 1, p, &vm);
> +	up_read(&current->mm->mmap_sem);
> +	if (n != 1) {
> +		_IPATH_INFO("get_user_pages for 0x%lx failed with %d\n",
> +			    start_page, n);
> +		if (n < 0)	/* it's an errno */
> +			return n;
> +		/*
> +		 * If we ever ask for more than a single page, we will have to
> +		 * free the pages (if any) that we did get, via ipath_get_upages()
> +		 * or put_page() directly.
> +		 */
> +		return -ENOMEM;	/* no way to know actual error */
> +	}
> +	vm->vm_flags |= VM_SHM | VM_LOCKED;
> +
> +	return 0;
> +}


I hope you're not depending on the VM_LOCKED thing.. since the user can
just undo that easily!

(this is also why all this "sys_mlock from the driver" is traditionally
buggy to the point of being a roothole, things like some of the binary
3D drivers have had this security hole for a long time, as did some of
the early infiniband drivers)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/