linux-hardening - Re: [PATCH 0/3] x86/dumpstack: Inline copy_from_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Sep 2022 16:46:39 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     Kees Cook <keescook@...omium.org>,
        Matthew Wilcox <willy@...radead.org>,
        Uladzislau Rezki <urezki@...il.com>,
        Yu Zhao <yuzhao@...gle.com>, dev@...-flo.net,
        Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        x86@...nel.org, linux-perf-users@...r.kernel.org,
        linux-mm@...ck.org, linux-hardening@...r.kernel.org,
        linux-arch@...r.kernel.org
Subject: Re: [PATCH 0/3] x86/dumpstack: Inline copy_from_user_nmi()

On Fri, Sep 16, 2022 at 12:57:23PM -0700, Andrew Morton wrote:
> On Fri, 16 Sep 2022 06:59:51 -0700 Kees Cook <keescook@...omium.org> wrote:
> 
> > Hi,
> > 
> > This fixes a find_vmap_area() deadlock. The main fix is patch 2, repeated here:
> > 
> >     The check_object_size() helper under CONFIG_HARDENED_USERCOPY is
> >     designed to skip any checks where the length is known at compile time as
> >     a reasonable heuristic to avoid "likely known-good" cases. However, it can
> >     only do this when the copy_*_user() helpers are, themselves, inline too.
> > 
> >     Using find_vmap_area() requires taking a spinlock. The check_object_size()
> >     helper can call find_vmap_area() when the destination is in vmap memory.
> >     If show_regs() is called in interrupt context, it will attempt a call to
> >     copy_from_user_nmi(), which may call check_object_size() and then
> >     find_vmap_area(). If something in normal context happens to be in the
> >     middle of calling find_vmap_area() (with the spinlock held), the interrupt
> >     handler will hang forever.
> > 
> >     The copy_from_user_nmi() call is actually being called with a fixed-size
> >     length, so check_object_size() should never have been called in the
> >     first place. In order for check_object_size() to see that the length is
> >     a fixed size, inline copy_from_user_nmi(), as already done with all the
> >     other uaccess helpers.
> > 
> 
> Why is this so complicated.
> 
> There's virtually zero value in running all those debug checks from within
> copy_from_user_nmi().
> 
> --- a/arch/x86/lib/usercopy.c~a
> +++ a/arch/x86/lib/usercopy.c
> @@ -44,7 +44,7 @@ copy_from_user_nmi(void *to, const void
>  	 * called from other contexts.
>  	 */
>  	pagefault_disable();
> -	ret = __copy_from_user_inatomic(to, from, n);
> +	ret = raw_copy_from_user(to, from, n);
>  	pagefault_enable();
>  
>  	return ret;

I'm with Andrew here; this looks a *LOT* saner than all the other stuff.