linux-kernel - Re: [PATCH v2 4/9] x86, memcpy_mcsafe: add write-protection-fault handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 3 May 2018 07:19:23 -0700
From:   Dan Williams <dan.j.williams@...el.com>
To:     Mika Penttilä <mika.penttila@...tfour.com>
Cc:     linux-nvdimm <linux-nvdimm@...ts.01.org>, X86 ML <x86@...nel.org>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Tony Luck <tony.luck@...el.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andy Lutomirski <luto@...capital.net>,
        Peter Zijlstra <peterz@...radead.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Christoph Hellwig <hch@....de>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-fsdevel <linux-fsdevel@...r.kernel.org>
Subject: Re: [PATCH v2 4/9] x86, memcpy_mcsafe: add write-protection-fault handling

On Wed, May 2, 2018 at 10:29 PM, Mika Penttilä
<mika.penttila@...tfour.com> wrote:
> On 05/03/2018 07:59 AM, Dan Williams wrote:
>> In preparation for using memcpy_mcsafe() to handle user copies it needs
>> to be to handle write-protection faults while writing user pages. Add
>> MMU-fault handlers alongside the machine-check exception handlers.
>>
>> Note that the machine check fault exception handling makes assumptions
>> about source buffer alignment and poison alignment. In the write fault
>> case, given the destination buffer is arbitrarily aligned, it needs a
>> separate / additional fault handling approach. The mcsafe_handle_tail()
>> helper is reused. The @limit argument is set to @len since there is no
>> safety concern about retriggering an MMU fault, and this simplifies the
>> assembly.
>>
>
>> diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
>> index 75d3776123cc..9787f5ee0cf9 100644
>> --- a/arch/x86/lib/usercopy_64.c
>> +++ b/arch/x86/lib/usercopy_64.c
>> @@ -75,6 +75,23 @@ copy_user_handle_tail(char *to, char *from, unsigned len)
>>       return len;
>>  }
>>
>> +/*
>> + * Similar to copy_user_handle_tail, probe for the write fault point,
>> + * but reuse __memcpy_mcsafe in case a new read error is encountered.
>> + * clac() is handled in _copy_to_iter_mcsafe().
>> + */
>> +__visible unsigned long
>> +mcsafe_handle_tail(char *to, char *from, unsigned len)
>> +{
>> +     for (; len; --len, to++) {
>> +             unsigned long rem = memcpy_mcsafe(to, from, 1);
>> +
>
>
> Hmm why not
>         for (; len; --len, from++, to++)
>
>

Why not indeed. Great catch, I'll fix this and extend the unit test to
verify the data transfer as well.