[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1427981431.22575.21.camel@opteya.com>
Date: Thu, 02 Apr 2015 15:30:31 +0200
From: Yann Droneaud <ydroneaud@...eya.com>
To: Shachar Raindel <raindel@...lanox.com>, Haggai Eran
<haggaie@...lanox.com>, Sagi Grimberg <sagig@...lanox.com>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"<linux-rdma@...r.kernel.org> (linux-rdma@...r.kernel.org)"
<linux-rdma@...r.kernel.org>, "linux-kernel@...r.kernel.org"
<linux-kernel@...r.kernel.org>, "stable@...r.kernel.org"
<stable@...r.kernel.org>
Subject: Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical
memory access
Hi,
Le jeudi 02 avril 2015 à 10:52 +0000, Shachar Raindel a écrit :
> > -----Original Message-----
> > From: Yann Droneaud [mailto:ydroneaud@...eya.com]
> > Sent: Thursday, April 02, 2015 1:05 PM
> > Le mercredi 18 mars 2015 à 17:39 +0000, Shachar Raindel a écrit :
> > > + /*
> > > + * If the combination of the addr and size requested for this
> > memory
> > > + * region causes an integer overflow, return error.
> > > + */
> > > + if ((PAGE_ALIGN(addr + size) <= size) ||
> > > + (PAGE_ALIGN(addr + size) <= addr))
> > > + return ERR_PTR(-EINVAL);
> > > +
> >
> > Can access_ok() be used here ?
> >
> > if (!access_ok(writable ? VERIFY_WRITE : VERIFY_READ,
> > addr, size))
> > return ERR_PTR(-EINVAL);
> >
>
> No, this will break the current ODP semantics.
>
> ODP allows the user to register memory that is not accessible yet.
> This is a critical design feature, as it allows avoiding holding
> a registration cache. Adding this check will break the behavior,
> forcing memory to be all accessible when registering an ODP MR.
>
Where's the check for the range being in userspace memory space,
especially for the ODP case ?
For non ODP case (eg. plain old behavior), does get_user_pages()
ensure the requested pages fit in userspace region on all
architectures ? I think so.
In ODP case, I'm not sure such check is ever done ?
(Aside, does it take special mesure to protect shared mapping from
being read and/or *written* ?)
Regards.
--
Yann Droneaud
OPTEYA
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
