[PATCH OLK-5.10 V1 0/2] RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
There are kABI changes on this patch, so we add another patch to fix that. This is the patchset for all those patches. Jason Gunthorpe (1): RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Yao Yiqi (1): RDMA/umem: fix ib_umem_find_best_pgsz kABI drivers/infiniband/core/umem.c | 18 ++++++++++++------ include/rdma/ib_umem.h | 4 ++-- 2 files changed, 14 insertions(+), 8 deletions(-) -- 2.34.1
From: Jason Gunthorpe <jgg@nvidia.com> stable inclusion from stable-v6.6.158 commit e9bbb5f5349ef560ff6f0395564f04c3aa664559 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19925 CVE: CVE-2026-97421 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 09ea6837a0434fb4db99528a5055b6d822135dcf ] Several corner cases, especially important on 32 bits: - umem->iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the length is not too large for the iova - Check that lengths > 4G don't overflow the GENMASK Link: https://patch.msgid.link/r/2-v1-88303e9e509f+f7-ib_umem_types_jgg@nvidia.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: drivers/infiniband/core/umem.c include/rdma/ib_umem.h [ Context conflicts. ] Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com> --- drivers/infiniband/core/umem.c | 18 ++++++++++++------ include/rdma/ib_umem.h | 4 ++-- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c index aba848f6c47c..7b541a91100b 100644 --- a/drivers/infiniband/core/umem.c +++ b/drivers/infiniband/core/umem.c @@ -87,11 +87,14 @@ static void __ib_umem_release(struct ib_device *dev, struct ib_umem *umem, int d */ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - unsigned long virt) + u64 virt) { struct scatterlist *sg; - unsigned long va, pgoff; - dma_addr_t mask; + unsigned long pgoff; + unsigned long mask = 0; + unsigned int bits; + u64 last_va; + u64 va; int i; /* rdma_for_each_block() has a bug if the page size is smaller than the @@ -109,9 +112,12 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, * number of required pages. Compute the largest page size that could * work based on VA address bits that don't change. */ - mask = pgsz_bitmap & - GENMASK(BITS_PER_LONG - 1, - bits_per((umem->length - 1 + virt) ^ virt)); + if (check_add_overflow(umem->length - 1, virt, &last_va)) + return 0; + bits = bits_per(virt ^ last_va); + if (bits < BITS_PER_LONG) + mask = pgsz_bitmap & GENMASK(BITS_PER_LONG - 1, bits); + /* offset into first SGL */ pgoff = umem->address & ~PAGE_MASK; diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index 164fa0bfacbe..f1f4c77a93dc 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -92,7 +92,7 @@ int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length); unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - unsigned long virt); + u64 virt); #ifdef CONFIG_INFINIBAND_PEER_MEMORY struct ib_umem *ib_umem_get_peer(struct ib_device *device, unsigned long addr, size_t size, int access, @@ -120,7 +120,7 @@ static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offs } static inline unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - unsigned long virt) + u64 virt) { return 0; } -- 2.34.1
Offering: HULK hulk inclusion category: bugfix bugzilla: NA -------------------------------- Last commit changes ib_umem_find_best_pgsz function signature. unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - unsigned long virt) + u64 virt) The u64 virt change will break the kABI. u64 is equivalent to unsigned long long on Linux kernel, use unsigned long KABI_ADD_MODIFIER(long) to fix this problem. Fixes: c89b50342035 ("[Backport] RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()") Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com> --- drivers/infiniband/core/umem.c | 2 +- include/rdma/ib_umem.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c index 7b541a91100b..143628f38633 100644 --- a/drivers/infiniband/core/umem.c +++ b/drivers/infiniband/core/umem.c @@ -87,7 +87,7 @@ static void __ib_umem_release(struct ib_device *dev, struct ib_umem *umem, int d */ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - u64 virt) + unsigned long KABI_ADD_MODIFIER(long) virt) { struct scatterlist *sg; unsigned long pgoff; diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h index f1f4c77a93dc..cb39d86df2fd 100644 --- a/include/rdma/ib_umem.h +++ b/include/rdma/ib_umem.h @@ -92,7 +92,7 @@ int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, size_t length); unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - u64 virt); + unsigned long KABI_ADD_MODIFIER(long) virt); #ifdef CONFIG_INFINIBAND_PEER_MEMORY struct ib_umem *ib_umem_get_peer(struct ib_device *device, unsigned long addr, size_t size, int access, @@ -120,7 +120,7 @@ static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offs } static inline unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, unsigned long pgsz_bitmap, - u64 virt) + unsigned long KABI_ADD_MODIFIER(long) virt) { return 0; } -- 2.34.1
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/30214 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/ZJH... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/30214 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/ZJH...
participants (2)
-
patchwork bot -
Yao Yiqi