linux-kernel - Re: why "probe_kernel_address()", not "probe_user

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0610281258060.2652@localhost.localdomain>
Date:	Sat, 28 Oct 2006 13:02:35 -0400 (EDT)
From:	"Robert P. J. Day" <rpjday@...dspring.com>
To:	Andrew Morton <akpm@...l.org>
cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: why "probe_kernel_address()", not "probe_user_address()"?

On Sat, 28 Oct 2006, Andrew Morton wrote:

> On Sat, 28 Oct 2006 11:56:24 -0400 (EDT)
> "Robert P. J. Day" <rpjday@...dspring.com> wrote:
>
> >
> >   it seems odd that the purpose of the "probe_kernel_address()" macro
> > is, in fact, to probe a *user* address (from linux/uaccess.h):
> >
> > #define probe_kernel_address(addr, retval)              \
> >         ({                                              \
> >                 long ret;                               \
> >                                                         \
> >                 inc_preempt_count();                    \
> >                 ret = __get_user(retval, addr);         \
> >                 dec_preempt_count();                    \
> >                 ret;                                    \
> >         })
> >
> >   given that that routine is referenced only 5 places in the entire
> > source tree, wouldn't it be more meaningful to use a more appropriate
> > name?
> >
>
> You'll notice that all callers are indeed probing kernel addresses.
> The function _could_ be used for user addresses and could perhaps be
> called probe_address().
>
> One of the reasons this wrapper exists is to communicate that the
> __get_user() it is in fact not being used to access user memory.

one quick addition to this.  in arch/i386/kernel/traps.c, we have the
code snippet:

        if (eip < PAGE_OFFSET)
                return;
        if (probe_kernel_address((unsigned short __user *)eip, ud2))
                return;
        if (ud2 != 0x0b0f)
                return;

        printk(KERN_EMERG "------------[ cut here ]------------\n");

#ifdef CONFIG_DEBUG_BUGVERBOSE
        do {
                unsigned short line;
                char *file;
                char c;

                if (probe_kernel_address((unsigned short __user *)(eip + 2),
                                        line))
... etc etc ...

  if those pointers qualified by "__user" *aren't* actually addresses
into user space, that would seem to violate what i read in the book
"linux device drivers (3rd ed)", p. 50:

"This [__user] annotation is a form of documentation, noting that a
pointer is a user-space address that cannot be directly dereferenced.
For normal compilation, __user has no effect, but it can be used by
external checking software to find misuse of user-space addresses."

  under the circumstances, wouldn't this show up as one of those
misuses?

rday
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/