The patch titled Subject: media/v4l2-core: untag user pointers in videobuf_dma_contig_user_get has been added to the -mm tree. Its filename is media-v4l2-core-untag-user-pointers-in-videobuf_dma_contig_user_get.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/media-v4l2-core-untag-user-pointers-in-videobuf_dma_contig_user_get.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/media-v4l2-core-untag-user-pointers-in-videobuf_dma_contig_user_get.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Andrey Konovalov <andreyknvl@xxxxxxxxxx> Subject: media/v4l2-core: untag user pointers in videobuf_dma_contig_user_get This patch is a part of a series that extends kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments. videobuf_dma_contig_user_get() uses provided user pointers for vma lookups, which can only by done with untagged pointers. Untag the pointers in this function. Link: http://lkml.kernel.org/r/100436d5f8e4349a78f27b0bbb27e4801fcb946b.1563904656.git.andreyknvl@xxxxxxxxxx Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx> Reviewed-by: Khalid Aziz <khalid.aziz@xxxxxxxxxx> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> Acked-by: Mauro Carvalho Chehab <mchehab+samsung@xxxxxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Catalin Marinas <catalin.marinas@xxxxxxx> Cc: Dave Hansen <dave.hansen@xxxxxxxxx> Cc: Eric Auger <eric.auger@xxxxxxxxxx> Cc: Felix Kuehling <Felix.Kuehling@xxxxxxx> Cc: Jens Wiklander <jens.wiklander@xxxxxxxxxx> Cc: Mike Rapoport <rppt@xxxxxxxxxxxxx> Cc: Vincenzo Frascino <vincenzo.frascino@xxxxxxx> Cc: Will Deacon <will@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/media/v4l2-core/videobuf-dma-contig.c~media-v4l2-core-untag-user-pointers-in-videobuf_dma_contig_user_get +++ a/drivers/media/v4l2-core/videobuf-dma-contig.c @@ -157,6 +157,7 @@ static void videobuf_dma_contig_user_put static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem, struct videobuf_buffer *vb) { + unsigned long untagged_baddr = untagged_addr(vb->baddr); struct mm_struct *mm = current->mm; struct vm_area_struct *vma; unsigned long prev_pfn, this_pfn; @@ -164,22 +165,22 @@ static int videobuf_dma_contig_user_get( unsigned int offset; int ret; - offset = vb->baddr & ~PAGE_MASK; + offset = untagged_baddr & ~PAGE_MASK; mem->size = PAGE_ALIGN(vb->size + offset); ret = -EINVAL; down_read(&mm->mmap_sem); - vma = find_vma(mm, vb->baddr); + vma = find_vma(mm, untagged_baddr); if (!vma) goto out_up; - if ((vb->baddr + mem->size) > vma->vm_end) + if ((untagged_baddr + mem->size) > vma->vm_end) goto out_up; pages_done = 0; prev_pfn = 0; /* kill warning */ - user_address = vb->baddr; + user_address = untagged_baddr; while (pages_done < (mem->size >> PAGE_SHIFT)) { ret = follow_pfn(vma, user_address, &this_pfn); _ Patches currently in -mm which might be from andreyknvl@xxxxxxxxxx are lib-untag-user-pointers-in-strn_user.patch mm-untag-user-pointers-passed-to-memory-syscalls.patch mm-untag-user-pointers-in-mm-gupc.patch mm-untag-user-pointers-in-get_vaddr_frames.patch fs-namespace-untag-user-pointers-in-copy_mount_options.patch userfaultfd-untag-user-pointers.patch drm-amdgpu-untag-user-pointers.patch drm-radeon-untag-user-pointers-in-radeon_gem_userptr_ioctl.patch media-v4l2-core-untag-user-pointers-in-videobuf_dma_contig_user_get.patch tee-shm-untag-user-pointers-in-tee_shm_register.patch vfio-type1-untag-user-pointers-in-vaddr_get_pfn.patch