linux-kernel - Re: [BUG] __copy_to_user_inatomic broken on non Pentium machines

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 25 Mar 2007 11:14:13 -0700 (PDT)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Thomas Gleixner <tglx@...utronix.de>
cc:	LKML <linux-kernel@...r.kernel.org>,
	Stable Kernel Team <stable@...nel.org>,
	Ingo Molnar <mingo@...e.hu>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Adrian Bunk <bunk@...sta.de>
Subject: Re: [BUG] __copy_to_user_inatomic broken on non Pentium machines

On Sun, 25 Mar 2007, Thomas Gleixner wrote:
>
> Environment: Pre Pentium systems, (boot_cpu_data.wp_works_ok == 0)

This shouldn't be "pre-pentium", afaik. WP-works-ok on i486 too. I think 
only the original i386 had this bug ("feature").

But I agree, it does seem to be broken on such machines (I assume you 
don't actually have one, but just tested by forcing it by hand ;)

> Now __copy_to_user_ll() takes the (boot_cpu_data.wp_works_ok == 0) path,
> which in turn calls 
> 
> down_read(current->mm->mmap_sem) - which might sleep
> 
> and
> 
> get_user_pages() - which has a cond_resched() inside.
> 
> Not sure how to fix that.

I agree. Nasty. But the thing is, it's actually much worse. We use 
"__put_user()" earlier to try to fault it in writably, and that one is 
totally broken on a CPU where wp_works_ok isn't set.

The whole notion that we should do this at access time is broken.

We should go back to doing it at "access_ok()", or we should just state 
that we don't support original-i386 CPU's any more. As it is, we don't do 
it right *anyway*, since we only do the tests properly in 
__copy_to_user(), and totally miss them in __put_user() and friends.

So it's buggy on i386 however you try to fix it. The only way to fix it 
properly is to move the i386 fixup early, into "access_ok()", the way it 
used to be. 

		Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/