RE: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

> -----Original Message-----
> From: Yann Droneaud [mailto:ydroneaud@xxxxxxxxxx]
> Sent: Thursday, April 02, 2015 6:16 PM
> To: Shachar Raindel
> Cc: oss-security@xxxxxxxxxxxxxxxxxx; <linux-rdma@xxxxxxxxxxxxxxx>
> (linux-rdma@xxxxxxxxxxxxxxx); linux-kernel@xxxxxxxxxxxxxxx;
> stable@xxxxxxxxxxxxxxx
> Subject: Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected
> physical memory access
> 
> Hi,
> Le jeudi 02 avril 2015 à 10:52 +0000, Shachar Raindel a écrit :
> > > -----Original Message-----
> > > From: Yann Droneaud [mailto:ydroneaud@xxxxxxxxxx]
> > > Sent: Thursday, April 02, 2015 1:05 PM
> > > Le mercredi 18 mars 2015 à 17:39 +0000, Shachar Raindel a écrit :
> ...
> > > > +	/*
> > > > +	 * If the combination of the addr and size requested for this
> > > memory
> > > > +	 * region causes an integer overflow, return error.
> > > > +	 */
> > > > +	if ((PAGE_ALIGN(addr + size) <= size) ||
> > > > +	    (PAGE_ALIGN(addr + size) <= addr))
> > > > +		return ERR_PTR(-EINVAL);
> > > > +
> > >
> > > Can access_ok() be used here ?
> > >
> > >          if (!access_ok(writable ? VERIFY_WRITE : VERIFY_READ,
> > >                         addr, size))
> > >                   return ERR_PTR(-EINVAL);
> > >
> >
> > No, this will break the current ODP semantics.
> >
> > ODP allows the user to register memory that is not accessible yet.
> > This is a critical design feature, as it allows avoiding holding
> > a registration cache. Adding this check will break the behavior,
> > forcing memory to be all accessible when registering an ODP MR.
> >
> 
> Failed to notice previously, but since this would break ODP, and ODP is
> only available starting v3.19-rc1, my proposed fix might be applicable
> for older kernel (if not better).
> 

Can you explain how this proposed fix is better than the existing patch?
Why do we want to push to the stable tree a patch that is not in the
upstream? There is an existing, tested, patch that is going to the tip
of the development. It even applies cleanly on every kernel version around.

Thanks,
--Shachar
��.n��������+%������w��{.n�����������ܨ}���Ơz�j:+v�����w����ޙ��&�)ߡ�a����z�ޗ���ݢj��w�f





[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]