On Sun, Jun 17, 2018 at 12:59:52PM +0300, Leon Romanovsky wrote:
> From: Matan Barak
>
> Adding UVERBS_ATTR_SPEC_F_ALLOC_AND_COPY flag to PTR_IN attributes.
> By using this flag, the parse automatically allocates and copies the
> user-space data. This data is accessible by using uverbs_attr_get_len
> and uverbs_attr_get_alloced_ptr inline accessor functions from the
> handler.
>
> Signed-off-by: Matan Barak
> Signed-off-by: Yishai Hadas
> Signed-off-by: Leon Romanovsky
> drivers/infiniband/core/uverbs_ioctl.c | 25 -
> include/rdma/uverbs_ioctl.h| 25 +
> 2 files changed, 49 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/uverbs_ioctl.c
> b/drivers/infiniband/core/uverbs_ioctl.c
> index 8cc3e8dad9b5..ee15c9ca788b 100644
> +++ b/drivers/infiniband/core/uverbs_ioctl.c
> @@ -114,7 +114,26 @@ static int uverbs_process_attr(struct ib_device *ibdev,
> uattr->attr_data.reserved)
> return -EINVAL;
>
> - e->ptr_attr.data = uattr->data;
> + if (val_spec->flags & UVERBS_ATTR_SPEC_F_ALLOC_AND_COPY &&
> + uattr->len > sizeof(((struct ib_uverbs_attr *)0)->data)) {
Why open-code uverbs_attr_ptr_is_inline() ?
> diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h
> index bd6bba3a6e04..0e6f782727bd 100644
> +++ b/include/rdma/uverbs_ioctl.h
> @@ -65,6 +65,8 @@ enum {
> UVERBS_ATTR_SPEC_F_MANDATORY= 1U << 0,
> /* Support extending attributes by length, validate all unknown size ==
> zero */
> UVERBS_ATTR_SPEC_F_MIN_SZ_OR_ZERO = 1U << 1,
> + /* Valid only for PTR_IN. Allocate and copy the data inside the parser
> */
> + UVERBS_ATTR_SPEC_F_ALLOC_AND_COPY = 1U << 2,
> };
>
> /* Specification of a single attribute inside the ioctl message */
> @@ -431,6 +433,17 @@ static inline struct ib_uobject
> *uverbs_attr_get_uobject(const struct uverbs_att
> return attr->obj_attr.uobject;
> }
>
> +static inline int uverbs_attr_get_len(const struct uverbs_attr_bundle
> *attrs_bundle,
> + u16 idx)
> +{
> + const struct uverbs_attr *attr = uverbs_attr_get(attrs_bundle, idx);
> +
> + if (IS_ERR(attr))
> + return PTR_ERR(attr);
> +
> + return attr->ptr_attr.len;
> +}
> +
> static inline int uverbs_copy_to(const struct uverbs_attr_bundle
> *attrs_bundle,
>size_t idx, const void *from, size_t size)
> {
> @@ -457,6 +470,18 @@ static inline bool uverbs_attr_ptr_is_inline(const
> struct uverbs_attr *attr)
> return attr->ptr_attr.len <= sizeof(attr->ptr_attr.data);
> }
>
> +static inline void *uverbs_attr_get_alloced_ptr(const struct
> uverbs_attr_bundle *attrs_bundle,
> + u16 idx)
> +{
> + const struct uverbs_attr *attr = uverbs_attr_get(attrs_bundle, idx);
> +
> + if (IS_ERR(attr))
> + return (void *)attr;
> +
> + return uverbs_attr_ptr_is_inline(attr) ? u64_to_ptr(void *,
> attr->ptr_attr.data) :
> + u64_to_ptr(void, attr->ptr_attr.data);
WTF is this:
u64_to_ptr(void *, attr->ptr_attr.data)
That returns attr->ptr_attr.data casted to a void **, then casts it to
a void * - which is identical to u64_to_ptr(void, attr->ptr_attr.data)
It should be &attr->ptr_attr.data. And the return should be const, the
caller shouldn't be mutating the copy.
All this use of u64_to_ptr is ugly needless obfuscation here, and
look, it causes bugs. Use a union.
Like this:
diff --git a/drivers/infiniband/core/uverbs_ioctl.c
b/drivers/infiniband/core/uverbs_ioctl.c
index 8cc3e8dad9b506..82c5d33195dfc7 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -114,9 +114,27 @@ static int uverbs_process_attr(struct ib_device *ibdev,
uattr->attr_data.reserved)
return -EINVAL;
- e->ptr_attr.data = uattr->data;
e->ptr_attr.len = uattr->len;
e->ptr_attr.flags = uattr->flags;
+
+ if (val_spec->flags & UVERBS_ATTR_SPEC_F_ALLOC_AND_COPY &&
+ !uverbs_attr_ptr_is_inline(e)) {
+ void *p;
+
+ p = kvmalloc(uattr->len, GFP_KERNEL);
+ if (!p)
+ return -ENOMEM;
+
+ e->ptr_attr.ptr = p;
+
+ if (copy_from_user(p, u64_to_user_ptr(uattr->data),
+ uattr->len)) {
+ kvfree(p);
+ return -EFAULT;
+ }
+ } else {
+ e->ptr_attr.data = uattr->data;
+ }
break;
case UVERBS_ATTR_TYPE_IDR:
@@ -201,6 +219,10 @@ static int uverbs_finalize_attrs(struct uverbs_attr_bundle
*attrs_bundl
