lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <YyiAz4gs4TvTqrvI@hirez.programming.kicks-ass.net> Date: Mon, 19 Sep 2022 16:46:39 +0200 From: Peter Zijlstra <peterz@...radead.org> To: Andrew Morton <akpm@...ux-foundation.org> Cc: Kees Cook <keescook@...omium.org>, Matthew Wilcox <willy@...radead.org>, Uladzislau Rezki <urezki@...il.com>, Yu Zhao <yuzhao@...gle.com>, dev@...-flo.net, Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org, x86@...nel.org, linux-perf-users@...r.kernel.org, linux-mm@...ck.org, linux-hardening@...r.kernel.org, linux-arch@...r.kernel.org Subject: Re: [PATCH 0/3] x86/dumpstack: Inline copy_from_user_nmi() On Fri, Sep 16, 2022 at 12:57:23PM -0700, Andrew Morton wrote: > On Fri, 16 Sep 2022 06:59:51 -0700 Kees Cook <keescook@...omium.org> wrote: > > > Hi, > > > > This fixes a find_vmap_area() deadlock. The main fix is patch 2, repeated here: > > > > The check_object_size() helper under CONFIG_HARDENED_USERCOPY is > > designed to skip any checks where the length is known at compile time as > > a reasonable heuristic to avoid "likely known-good" cases. However, it can > > only do this when the copy_*_user() helpers are, themselves, inline too. > > > > Using find_vmap_area() requires taking a spinlock. The check_object_size() > > helper can call find_vmap_area() when the destination is in vmap memory. > > If show_regs() is called in interrupt context, it will attempt a call to > > copy_from_user_nmi(), which may call check_object_size() and then > > find_vmap_area(). If something in normal context happens to be in the > > middle of calling find_vmap_area() (with the spinlock held), the interrupt > > handler will hang forever. > > > > The copy_from_user_nmi() call is actually being called with a fixed-size > > length, so check_object_size() should never have been called in the > > first place. In order for check_object_size() to see that the length is > > a fixed size, inline copy_from_user_nmi(), as already done with all the > > other uaccess helpers. > > > > Why is this so complicated. > > There's virtually zero value in running all those debug checks from within > copy_from_user_nmi(). > > --- a/arch/x86/lib/usercopy.c~a > +++ a/arch/x86/lib/usercopy.c > @@ -44,7 +44,7 @@ copy_from_user_nmi(void *to, const void > * called from other contexts. > */ > pagefault_disable(); > - ret = __copy_from_user_inatomic(to, from, n); > + ret = raw_copy_from_user(to, from, n); > pagefault_enable(); > > return ret; I'm with Andrew here; this looks a *LOT* saner than all the other stuff.
Powered by blists - more mailing lists