Hi, > -----Original Message----- > From: Yann Droneaud [mailto:ydroneaud@xxxxxxxxxx] > Sent: Thursday, April 02, 2015 6:16 PM > To: Shachar Raindel > Cc: oss-security@xxxxxxxxxxxxxxxxxx; <linux-rdma@xxxxxxxxxxxxxxx> > (linux-rdma@xxxxxxxxxxxxxxx); linux-kernel@xxxxxxxxxxxxxxx; > stable@xxxxxxxxxxxxxxx > Subject: Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected > physical memory access > > Hi, > Le jeudi 02 avril 2015 à 10:52 +0000, Shachar Raindel a écrit : > > > -----Original Message----- > > > From: Yann Droneaud [mailto:ydroneaud@xxxxxxxxxx] > > > Sent: Thursday, April 02, 2015 1:05 PM > > > Le mercredi 18 mars 2015 à 17:39 +0000, Shachar Raindel a écrit : > ... > > > > + /* > > > > + * If the combination of the addr and size requested for this > > > memory > > > > + * region causes an integer overflow, return error. > > > > + */ > > > > + if ((PAGE_ALIGN(addr + size) <= size) || > > > > + (PAGE_ALIGN(addr + size) <= addr)) > > > > + return ERR_PTR(-EINVAL); > > > > + > > > > > > Can access_ok() be used here ? > > > > > > if (!access_ok(writable ? VERIFY_WRITE : VERIFY_READ, > > > addr, size)) > > > return ERR_PTR(-EINVAL); > > > > > > > No, this will break the current ODP semantics. > > > > ODP allows the user to register memory that is not accessible yet. > > This is a critical design feature, as it allows avoiding holding > > a registration cache. Adding this check will break the behavior, > > forcing memory to be all accessible when registering an ODP MR. > > > > Failed to notice previously, but since this would break ODP, and ODP is > only available starting v3.19-rc1, my proposed fix might be applicable > for older kernel (if not better). > Can you explain how this proposed fix is better than the existing patch? Why do we want to push to the stable tree a patch that is not in the upstream? There is an existing, tested, patch that is going to the tip of the development. It even applies cleanly on every kernel version around. Thanks, --Shachar ��.n��������+%������w��{.n�����{���fk��ܨ}���Ơz�j:+v�����w����ޙ��&�)ߡ�a����z�ޗ���ݢj��w�f
