Commit 8dfa57aa authored by Vinicius Costa Gomes's avatar Vinicius Costa Gomes Committed by Vinod Koul
Browse files

dmaengine: idxd: Fix allowing write() from different address spaces 



Check if the process submitting the descriptor belongs to the same
address space as the one that opened the file, reject otherwise.

Fixes: 6827738d ("dmaengine: idxd: add a write() method for applications to submit work")
Signed-off-by: default avatarVinicius Costa Gomes <vinicius.gomes@intel.com>
Signed-off-by: default avatarDave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20250421170337.3008875-1-dave.jiang@intel.com


Signed-off-by: default avatarVinod Koul <vkoul@kernel.org>
parent fca28099

drivers/dma/idxd/cdev.c

+9 −0
Original line number Diff line number Diff line
@@ -407,6 +407,9 @@ static int idxd_cdev_mmap(struct file *filp, struct vm_area_struct *vma) 
	if (!idxd->user_submission_safe && !capable(CAP_SYS_RAWIO))

		return -EPERM;



	if (current->mm != ctx->mm)

		return -EPERM;



	rc = check_vma(wq, vma, __func__);

	if (rc < 0)

		return rc;
@@ -473,6 +476,9 @@ static ssize_t idxd_cdev_write(struct file *filp, const char __user *buf, size_t 
	ssize_t written = 0;

	int i;



	if (current->mm != ctx->mm)

		return -EPERM;



	for (i = 0; i < len/sizeof(struct dsa_hw_desc); i++) {

		int rc = idxd_submit_user_descriptor(ctx, udesc + i);
@@ -493,6 +499,9 @@ static __poll_t idxd_cdev_poll(struct file *filp, 
	struct idxd_device *idxd = wq->idxd;

	__poll_t out = 0;



	if (current->mm != ctx->mm)

		return -EPERM;



	poll_wait(filp, &wq->err_queue, wait);

	spin_lock(&idxd->dev_lock);

	if (idxd->sw_err.valid)