From: Zhangfei Gao <zhangfei.gao@linaro.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Arnd Bergmann <arnd@arndb.de>,
Herbert Xu <herbert@gondor.apana.org.au>,
jonathan.cameron@huawei.com, dave.jiang@intel.com,
grant.likely@arm.com, jean-philippe <jean-philippe@linaro.org>,
Jerome Glisse <jglisse@redhat.com>,
ilias.apalodimas@linaro.org, francois.ozog@linaro.org,
kenneth-lee-2012@foxmail.com, Wangzhou <wangzhou1@hisilicon.com>,
"haojian . zhuang" <haojian.zhuang@linaro.org>,
guodong.xu@linaro.org
Cc: linux-accelerators@lists.ozlabs.org,
linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
iommu@lists.linux-foundation.org,
Zhangfei Gao <zhangfei.gao@linaro.org>
Subject: [PATCH v2] uacce: unmap remaining mmapping from user space
Date: Wed, 26 Feb 2020 15:12:06 +0800 [thread overview]
Message-ID: <1582701126-5312-1-git-send-email-zhangfei.gao@linaro.org> (raw)
When uacce parent device module is removed, user app may
still keep the mmaped area, which can be accessed unsafely.
When rmmod, Parent device driver will call uacce_remove,
which unmap all remaining mapping from user space for safety.
VM_FAULT_SIGBUS is also reported to user space accordingly.
Suggested-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Zhangfei Gao <zhangfei.gao@linaro.org>
---
v2: Unmap before put_queue, where memory is freed, commented from Zaibo.
drivers/misc/uacce/uacce.c | 16 ++++++++++++++++
include/linux/uacce.h | 2 ++
2 files changed, 18 insertions(+)
diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c
index ffced4d..d39307f 100644
--- a/drivers/misc/uacce/uacce.c
+++ b/drivers/misc/uacce/uacce.c
@@ -224,6 +224,7 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)
init_waitqueue_head(&q->wait);
filep->private_data = q;
+ uacce->inode = inode;
q->state = UACCE_Q_INIT;
return 0;
@@ -253,6 +254,14 @@ static int uacce_fops_release(struct inode *inode, struct file *filep)
return 0;
}
+static vm_fault_t uacce_vma_fault(struct vm_fault *vmf)
+{
+ if (vmf->flags & (FAULT_FLAG_MKWRITE | FAULT_FLAG_WRITE))
+ return VM_FAULT_SIGBUS;
+
+ return 0;
+}
+
static void uacce_vma_close(struct vm_area_struct *vma)
{
struct uacce_queue *q = vma->vm_private_data;
@@ -265,6 +274,7 @@ static void uacce_vma_close(struct vm_area_struct *vma)
}
static const struct vm_operations_struct uacce_vm_ops = {
+ .fault = uacce_vma_fault,
.close = uacce_vma_close,
};
@@ -556,6 +566,12 @@ void uacce_remove(struct uacce_device *uacce)
if (!uacce)
return;
+ /*
+ * unmap remaining mapping from user space, preventing user still
+ * access the mmaped area while parent device is already removed
+ */
+ if (uacce->inode)
+ unmap_mapping_range(uacce->inode->i_mapping, 0, 0, 1);
/* ensure no open queue remains */
mutex_lock(&uacce->mm_lock);
diff --git a/include/linux/uacce.h b/include/linux/uacce.h
index 904a461..0e215e6 100644
--- a/include/linux/uacce.h
+++ b/include/linux/uacce.h
@@ -98,6 +98,7 @@ struct uacce_queue {
* @priv: private pointer of the uacce
* @mm_list: list head of uacce_mm->list
* @mm_lock: lock for mm_list
+ * @inode: core vfs
*/
struct uacce_device {
const char *algs;
@@ -113,6 +114,7 @@ struct uacce_device {
void *priv;
struct list_head mm_list;
struct mutex mm_lock;
+ struct inode *inode;
};
/**
--
2.7.4
next reply other threads:[~2020-02-26 7:13 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-26 7:12 Zhangfei Gao [this message]
2020-03-06 1:51 ` [PATCH v2] uacce: unmap remaining mmapping from user space Herbert Xu
2020-03-06 2:36 ` zhangfei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1582701126-5312-1-git-send-email-zhangfei.gao@linaro.org \
--to=zhangfei.gao@linaro.org \
--cc=arnd@arndb.de \
--cc=dave.jiang@intel.com \
--cc=francois.ozog@linaro.org \
--cc=grant.likely@arm.com \
--cc=gregkh@linuxfoundation.org \
--cc=guodong.xu@linaro.org \
--cc=haojian.zhuang@linaro.org \
--cc=herbert@gondor.apana.org.au \
--cc=ilias.apalodimas@linaro.org \
--cc=iommu@lists.linux-foundation.org \
--cc=jean-philippe@linaro.org \
--cc=jglisse@redhat.com \
--cc=jonathan.cameron@huawei.com \
--cc=kenneth-lee-2012@foxmail.com \
--cc=linux-accelerators@lists.ozlabs.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=wangzhou1@hisilicon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).