search for: verify_read

Displaying 20 results from an estimated 98 matches for "verify_read".

2010 Oct 11
2
[patch 1/2] vhost: potential integer overflows
...t vring_avail __user *avail, struct vring_used __user *used) { + + if (num > UINT_MAX / sizeof *desc) + return 0; + if (num > UINT_MAX / sizeof *avail->ring - sizeof *avail) + return 0; + if (num > UINT_MAX / sizeof *used->ring - sizeof *used) + return 0; + return access_ok(VERIFY_READ, desc, num * sizeof *desc) && access_ok(VERIFY_READ, avail, sizeof *avail + num * sizeof *avail->ring) && @@ -447,6 +455,9 @@ int vhost_log_access_ok(struct vhost_dev *dev) /* Caller should have vq mutex and device mutex */ static int vq_log_access_ok(struct vhost...
2018 Jul 04
2
[PATCH net-next 8/8] vhost: event suppression for packed ring
...ed *)desc; > + struct vring_packed_desc_event *driver_event = > + (struct vring_packed_desc_event *)avail; > + struct vring_packed_desc_event *device_event = > + (struct vring_packed_desc_event *)used; > > - /* TODO: check device area and driver area */ > return access_ok(VERIFY_READ, packed, num * sizeof(*packed)) && > - access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)); > + access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)) && R/W parameter doesn't make sense to most architectures and the comment in x86 says WRITE is a superse...
2010 Oct 11
2
[patch 1/2] vhost: potential integer overflows
...t vring_avail __user *avail, struct vring_used __user *used) { + + if (num > UINT_MAX / sizeof *desc) + return 0; + if (num > UINT_MAX / sizeof *avail->ring - sizeof *avail) + return 0; + if (num > UINT_MAX / sizeof *used->ring - sizeof *used) + return 0; + return access_ok(VERIFY_READ, desc, num * sizeof *desc) && access_ok(VERIFY_READ, avail, sizeof *avail + num * sizeof *avail->ring) && @@ -447,6 +455,9 @@ int vhost_log_access_ok(struct vhost_dev *dev) /* Caller should have vq mutex and device mutex */ static int vq_log_access_ok(struct vhost...
2018 Jul 04
2
[PATCH net-next 8/8] vhost: event suppression for packed ring
...ed *)desc; > + struct vring_packed_desc_event *driver_event = > + (struct vring_packed_desc_event *)avail; > + struct vring_packed_desc_event *device_event = > + (struct vring_packed_desc_event *)used; > > - /* TODO: check device area and driver area */ > return access_ok(VERIFY_READ, packed, num * sizeof(*packed)) && > - access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)); > + access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)) && R/W parameter doesn't make sense to most architectures and the comment in x86 says WRITE is a superse...
2010 Apr 15
1
[PATCH] ocfs2: avoid direct write if we fall back to buffered v2
...cfs2/file.c index de059f4..0240de7 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1973,18 +1973,18 @@ relock: /* communicate with ocfs2_dio_end_io */ ocfs2_iocb_set_rw_locked(iocb, rw_level); - if (direct_io) { - ret = generic_segment_checks(iov, &nr_segs, &ocount, - VERIFY_READ); - if (ret) - goto out_dio; + ret = generic_segment_checks(iov, &nr_segs, &ocount, + VERIFY_READ); + if (ret) + goto out_dio; - count = ocount; - ret = generic_write_checks(file, ppos, &count, - S_ISBLK(inode->i_mode)); - if (ret) - goto out_dio; + count =...
2018 Jul 04
0
[PATCH net-next 8/8] vhost: event suppression for packed ring
...ring_packed_desc_event *driver_event = >> + (struct vring_packed_desc_event *)avail; >> + struct vring_packed_desc_event *device_event = >> + (struct vring_packed_desc_event *)used; >> >> - /* TODO: check device area and driver area */ >> return access_ok(VERIFY_READ, packed, num * sizeof(*packed)) && >> - access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)); >> + access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)) && > R/W parameter doesn't make sense to most architectures and the comment in x86 > says W...
2016 Aug 01
0
[vhost:vhost 14/14] drivers/vhost/vhost.c:915:30: warning: passing argument 2 of 'access_ok' makes pointer from integer without a cast
...ss ARCH=sparc64 All warnings (new ones prefixed by >>): drivers/vhost/vhost.c: In function 'umem_access_ok': >> drivers/vhost/vhost.c:915:30: warning: passing argument 2 of 'access_ok' makes pointer from integer without a cast [-Wint-conversion] !access_ok(VERIFY_READ, uaddr, size)) ^ In file included from arch/sparc/include/asm/uaccess.h:4:0, from include/linux/poll.h:11, from drivers/vhost/vhost.c:21: arch/sparc/include/asm/uaccess_64.h:79:19: note: expected 'const void *' b...
2016 Aug 01
0
[vhost:vhost 14/14] drivers/vhost/vhost.c:915:30: warning: passing argument 2 of 'access_ok' makes pointer from integer without a cast
...ss ARCH=sparc64 All warnings (new ones prefixed by >>): drivers/vhost/vhost.c: In function 'umem_access_ok': >> drivers/vhost/vhost.c:915:30: warning: passing argument 2 of 'access_ok' makes pointer from integer without a cast [-Wint-conversion] !access_ok(VERIFY_READ, uaddr, size)) ^ In file included from arch/sparc/include/asm/uaccess.h:4:0, from include/linux/poll.h:11, from drivers/vhost/vhost.c:21: arch/sparc/include/asm/uaccess_64.h:79:19: note: expected 'const void *' b...
2009 Dec 20
0
[PATCH 2/3] vhost: add access_ok checks
...mem, log_all); + else + ok = 1; + mutex_unlock(&d->vqs[i].mutex); + if (!ok) + return 0; + } + return 1; +} + +static int vq_access_ok(unsigned int num, + struct vring_desc __user *desc, + struct vring_avail __user *avail, + struct vring_used __user *used) +{ + return access_ok(VERIFY_READ, desc, num * sizeof *desc) && + access_ok(VERIFY_READ, avail, + sizeof *avail + num * sizeof *avail->ring) && + access_ok(VERIFY_WRITE, used, + sizeof *used + num * sizeof *used->ring); +} + +/* Can we log writes? */ +/* Caller should have device mutex but n...
2009 Dec 20
0
[PATCH 2/3] vhost: add access_ok checks
...mem, log_all); + else + ok = 1; + mutex_unlock(&d->vqs[i].mutex); + if (!ok) + return 0; + } + return 1; +} + +static int vq_access_ok(unsigned int num, + struct vring_desc __user *desc, + struct vring_avail __user *avail, + struct vring_used __user *used) +{ + return access_ok(VERIFY_READ, desc, num * sizeof *desc) && + access_ok(VERIFY_READ, avail, + sizeof *avail + num * sizeof *avail->ring) && + access_ok(VERIFY_WRITE, used, + sizeof *used + num * sizeof *used->ring); +} + +/* Can we log writes? */ +/* Caller should have device mutex but n...
2010 May 18
2
[PATCH] vhost-net: utilize PUBLISH_USED_IDX feature
...t vq_access_ok(unsigned int num, +static int vq_access_ok(struct vhost_dev *d, unsigned int num, struct vring_desc __user *desc, struct vring_avail __user *avail, struct vring_used __user *used) { + size_t s = vhost_has_feature(d, VIRTIO_RING_F_PUBLISH_USED) ? 2 : 0; return access_ok(VERIFY_READ, desc, num * sizeof *desc) && access_ok(VERIFY_READ, avail, - sizeof *avail + num * sizeof *avail->ring) && + sizeof *avail + num * sizeof *avail->ring + s) && access_ok(VERIFY_WRITE, used, sizeof *used + num * sizeof *used->ring); } @@...
2010 May 18
2
[PATCH] vhost-net: utilize PUBLISH_USED_IDX feature
...t vq_access_ok(unsigned int num, +static int vq_access_ok(struct vhost_dev *d, unsigned int num, struct vring_desc __user *desc, struct vring_avail __user *avail, struct vring_used __user *used) { + size_t s = vhost_has_feature(d, VIRTIO_RING_F_PUBLISH_USED) ? 2 : 0; return access_ok(VERIFY_READ, desc, num * sizeof *desc) && access_ok(VERIFY_READ, avail, - sizeof *avail + num * sizeof *avail->ring) && + sizeof *avail + num * sizeof *avail->ring + s) && access_ok(VERIFY_WRITE, used, sizeof *used + num * sizeof *used->ring); } @@...
2016 Jun 22
0
[PATCH 3/3] vhost: device IOTLB API
...OST_IOTLB_MISS) { + vhost_poll_queue(&node->vq->poll); + list_del(&node->node); + kfree(node); + } + } + + spin_unlock(&d->iotlb_lock); +} + +static int umem_access_ok(u64 uaddr, u64 size, int access) +{ + if ((access & VHOST_ACCESS_RO) && + !access_ok(VERIFY_READ, uaddr, size)) + return -EFAULT; + if ((access & VHOST_ACCESS_WO) && + !access_ok(VERIFY_WRITE, uaddr, size)) + return -EFAULT; + return 0; +} + +int vhost_process_iotlb_msg(struct vhost_dev *dev, + struct vhost_iotlb_msg *msg) +{ + int ret = 0; + + vhost_dev_lock_vqs(dev);...
2010 May 18
2
[PATCHv2] vhost-net: utilize PUBLISH_USED_IDX feature
...t vq_access_ok(unsigned int num, +static int vq_access_ok(struct vhost_dev *d, unsigned int num, struct vring_desc __user *desc, struct vring_avail __user *avail, struct vring_used __user *used) { + size_t s = vhost_has_feature(d, VIRTIO_RING_F_PUBLISH_USED) ? 2 : 0; return access_ok(VERIFY_READ, desc, num * sizeof *desc) && access_ok(VERIFY_READ, avail, - sizeof *avail + num * sizeof *avail->ring) && + sizeof *avail + num * sizeof *avail->ring + s) && access_ok(VERIFY_WRITE, used, sizeof *used + num * sizeof *used->ring); } @@...
2010 May 18
2
[PATCHv2] vhost-net: utilize PUBLISH_USED_IDX feature
...t vq_access_ok(unsigned int num, +static int vq_access_ok(struct vhost_dev *d, unsigned int num, struct vring_desc __user *desc, struct vring_avail __user *avail, struct vring_used __user *used) { + size_t s = vhost_has_feature(d, VIRTIO_RING_F_PUBLISH_USED) ? 2 : 0; return access_ok(VERIFY_READ, desc, num * sizeof *desc) && access_ok(VERIFY_READ, avail, - sizeof *avail + num * sizeof *avail->ring) && + sizeof *avail + num * sizeof *avail->ring + s) && access_ok(VERIFY_WRITE, used, sizeof *used + num * sizeof *used->ring); } @@...
2018 May 16
0
[RFC V4 PATCH 8/8] vhost: event suppression for packed ring
...*packed = (struct vring_desc_packed *)desc; + struct vring_packed_desc_event *driver_event = + (struct vring_packed_desc_event *)avail; + struct vring_packed_desc_event *device_event = + (struct vring_packed_desc_event *)used; - /* FIXME: check device area and driver area */ return access_ok(VERIFY_READ, packed, num * sizeof(*packed)) && - access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)); + access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)) && + access_ok(VERIFY_READ, driver_event, sizeof(*driver_event)) && + access_ok(VERIFY_WRITE, dev...
2018 Mar 26
0
[RFC PATCH V2 8/8] vhost: event suppression for packed ring
...*packed = (struct vring_desc_packed *)desc; + struct vring_packed_desc_event *driver_event = + (struct vring_packed_desc_event *)avail; + struct vring_packed_desc_event *device_event = + (struct vring_packed_desc_event *)used; - /* FIXME: check device area and driver area */ return access_ok(VERIFY_READ, packed, num * sizeof(*packed)) && - access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)); + access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)) && + access_ok(VERIFY_READ, driver_event, sizeof(*driver_event)) && + access_ok(VERIFY_WRITE, dev...
2018 Jul 03
0
[PATCH net-next 8/8] vhost: event suppression for packed ring
...d *packed = (struct vring_desc_packed *)desc; + struct vring_packed_desc_event *driver_event = + (struct vring_packed_desc_event *)avail; + struct vring_packed_desc_event *device_event = + (struct vring_packed_desc_event *)used; - /* TODO: check device area and driver area */ return access_ok(VERIFY_READ, packed, num * sizeof(*packed)) && - access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)); + access_ok(VERIFY_WRITE, packed, num * sizeof(*packed)) && + access_ok(VERIFY_READ, driver_event, sizeof(*driver_event)) && + access_ok(VERIFY_WRITE, dev...
2018 Nov 02
2
[PULL] vhost: cleanups and fixes
...*/ -#define access_ok(type, addr, size) \ +#define unsafe_access_ok(type, addr, size) \ ({ \ WARN_ON_IN_IRQ(); \ likely(!__range_not_ok(addr, size, user_addr_max())); \ }) +/** + * access_ok_nospec: - Checks if a user space pointer is valid + * @type: Type of access: %VERIFY_READ or %VERIFY_WRITE. Note that + * %VERIFY_WRITE is a superset of %VERIFY_READ - if it is safe + * to write to a block, it is always safe to read from it. + * @addr: User space pointer to start of block to check + * @size: Size of block to check + * + * Context: User context only. This...
2018 Nov 02
2
[PULL] vhost: cleanups and fixes
...*/ -#define access_ok(type, addr, size) \ +#define unsafe_access_ok(type, addr, size) \ ({ \ WARN_ON_IN_IRQ(); \ likely(!__range_not_ok(addr, size, user_addr_max())); \ }) +/** + * access_ok_nospec: - Checks if a user space pointer is valid + * @type: Type of access: %VERIFY_READ or %VERIFY_WRITE. Note that + * %VERIFY_WRITE is a superset of %VERIFY_READ - if it is safe + * to write to a block, it is always safe to read from it. + * @addr: User space pointer to start of block to check + * @size: Size of block to check + * + * Context: User context only. This...