public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-21 06:50:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

dmaengine: idxd: Fix allowing write() from different address spaces

Browse source 
Check if the process submitting the descriptor belongs to the same
address space as the one that opened the file, reject otherwise.

Fixes: 6827738dc6 ("dmaengine: idxd: add a write() method for applications to submit work")
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20250421170337.3008875-1-dave.jiang@intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
This commit is contained in:
Vinicius Costa Gomes 2025-04-21 10:03:37 -07:00 • committed by Vinod Koul
parent fca280992a
commit 8dfa57aabf
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/dma/idxd/cdev.c
View file

@ -407,6 +407,9 @@ static int idxd_cdev_mmap(struct file *filp, struct vm_area_struct *vma)
if (!idxd->user_submission_safe && !capable(CAP_SYS_RAWIO)) if (!idxd->user_submission_safe && !capable(CAP_SYS_RAWIO))
return -EPERM; return -EPERM;
if (current->mm != ctx->mm)
return -EPERM;
rc = check_vma(wq, vma, __func__); rc = check_vma(wq, vma, __func__);
if (rc < 0) if (rc < 0)
return rc; return rc;
@ -473,6 +476,9 @@ static ssize_t idxd_cdev_write(struct file *filp, const char __user *buf, size_t
ssize_t written = 0; ssize_t written = 0;
int i; int i;
if (current->mm != ctx->mm)
return -EPERM;
for (i = 0; i < len/sizeof(struct dsa_hw_desc); i++) { for (i = 0; i < len/sizeof(struct dsa_hw_desc); i++) {
int rc = idxd_submit_user_descriptor(ctx, udesc + i); int rc = idxd_submit_user_descriptor(ctx, udesc + i);
@ -493,6 +499,9 @@ static __poll_t idxd_cdev_poll(struct file *filp,
struct idxd_device *idxd = wq->idxd; struct idxd_device *idxd = wq->idxd;
__poll_t out = 0; __poll_t out = 0;
if (current->mm != ctx->mm)
return -EPERM;
poll_wait(filp, &wq->err_queue, wait); poll_wait(filp, &wq->err_queue, wait);
spin_lock(&idxd->dev_lock); spin_lock(&idxd->dev_lock);
if (idxd->sw_err.valid) if (idxd->sw_err.valid)