[openib-general] Re: [PATCH 12 of 20] ipath - misc driver support code

[Arjan van de Ven]

> +int ipath_get_upages_nocopy(unsigned long start_page, struct page **p)
> +{
> +     int n;
> +     struct vm_area_struct *vm = NULL;
> +
> +     down_read(&current->mm->mmap_sem);
> +     n = get_user_pages(current, current->mm, start_page, 1, 1, 1, p, &vm);
> +     up_read(&current->mm->mmap_sem);
> +     if (n != 1) {
> +             _IPATH_INFO("get_user_pages for 0x%lx failed with %d\n",
> +                         start_page, n);
> +             if (n < 0)      /* it's an errno */
> +                     return n;
> +             /*
> +              * If we ever ask for more than a single page, we will have to
> +              * free the pages (if any) that we did get, via 
> ipath_get_upages()
> +              * or put_page() directly.
> +              */
> +             return -ENOMEM; /* no way to know actual error */
> +     }
> +     vm->vm_flags |= VM_SHM | VM_LOCKED;
> +
> +     return 0;
> +}


I hope you're not depending on the VM_LOCKED thing.. since the user can
just undo that easily!

(this is also why all this "sys_mlock from the driver" is traditionally
buggy to the point of being a roothole, things like some of the binary
3D drivers have had this security hole for a long time, as did some of
the early infiniband drivers)

_______________________________________________
openib-general mailing list
openib-general@openib.org
http://openib.org/mailman/listinfo/openib-general

To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general