This patch is a part of a series that extends kernel ABI to allow to pass
tagged user pointers (with the top byte set to something else other than
0x00) as syscall arguments.

mlx4_get_umem_mr() uses provided user pointers for vma lookups, which can
only by done with untagged pointers.

Untag user pointers in this function.

Reviewed-by: Jason Gunthorpe <j...@mellanox.com>
Acked-by: Catalin Marinas <catalin.mari...@arm.com>
Reviewed-by: Kees Cook <keesc...@chromium.org>
Signed-off-by: Andrey Konovalov <andreyk...@google.com>
---
 drivers/infiniband/hw/mlx4/mr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 753479285ce9..6ae503cfc526 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -377,6 +377,7 @@ static struct ib_umem *mlx4_get_umem_mr(struct ib_udata 
*udata, u64 start,
         * again
         */
        if (!ib_access_writable(access_flags)) {
+               unsigned long untagged_start = untagged_addr(start);
                struct vm_area_struct *vma;
 
                down_read(&current->mm->mmap_sem);
@@ -385,9 +386,9 @@ static struct ib_umem *mlx4_get_umem_mr(struct ib_udata 
*udata, u64 start,
                 * cover the memory, but for now it requires a single vma to
                 * entirely cover the MR to support RO mappings.
                 */
-               vma = find_vma(current->mm, start);
-               if (vma && vma->vm_end >= start + length &&
-                   vma->vm_start <= start) {
+               vma = find_vma(current->mm, untagged_start);
+               if (vma && vma->vm_end >= untagged_start + length &&
+                   vma->vm_start <= untagged_start) {
                        if (vma->vm_flags & VM_WRITE)
                                access_flags |= IB_ACCESS_LOCAL_WRITE;
                } else {
-- 
2.22.0.709.g102302147b-goog

Reply via email to