linux-kernel - Re: [PATCH v3] mm/usercopy: get rid of CONFIG_DEBUG_STRICT_USER_COPY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 31 Aug 2016 10:43:47 +0100
From:   Mark Rutland <mark.rutland@....com>
To:     Al Viro <viro@...IV.linux.org.uk>
Cc:     Kees Cook <keescook@...omium.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        "H . Peter Anvin" <hpa@...or.com>,
        the arch/x86 maintainers <x86@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...capital.net>,
        Steven Rostedt <rostedt@...dmis.org>,
        Brian Gerst <brgerst@...il.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Frederic Weisbecker <fweisbec@...il.com>,
        Byungchul Park <byungchul.park@....com>,
        Nilay Vaish <nilayvaish@...il.com>
Subject: Re: [PATCH v3] mm/usercopy: get rid of
 CONFIG_DEBUG_STRICT_USER_COPY_CHECKS

On Tue, Aug 30, 2016 at 09:13:32PM +0100, Al Viro wrote:
> On Tue, Aug 30, 2016 at 02:15:58PM -0400, Kees Cook wrote:
> 
> > First, some current API usage which we'll need to maintain at least
> > for now: __copy_*_user() is just copy_*_user() without the access_ok()
> > checks. Unfortunately, some arch implement different copying methods
> > depending on if the entry is via copy...() or __copy..() (e.g. see
> > x86's use of _copy...() -- single underscore??) There doesn't seem to
> > be a good reason for this, and I think it would make sense to extract
> > the actual per-arch implementation that performs the real copy into
> > something like arm64's __arch_copy_*_user(), which only does the copy
> > itself and nothing else.
> 
> No.  __arch_copy_from_user() is a bloody bad idea; the real primitive
> is what's currently called __copy_from_user_inatomic(), and I'm planning
> to rename it to raw_copy_from_user(). 

Great!

FWIW, my plan with the arch_* forms was to follow the convention set by
the spinlock code and have raw_* forms build atop of these, where common
debug and/or hardening checks would live.

>From my PoV, anything to make this more consistent cross-architecture is
good, especially if we can pull the duplicated logic into common code.

Thanks,
Mark.