linux-kernel - Re: [PATCH] [iov_iter] use memmove() when copying to/from user page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 16 May 2017 11:53:01 -0700
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Al Viro <viro@...iv.linux.org.uk>
Cc:     Alexander Potapenko <glider@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] [iov_iter] use memmove() when copying to/from user page

On Tue, May 16, 2017 at 11:48 AM, Al Viro <viro@...iv.linux.org.uk> wrote:
> On Tue, May 16, 2017 at 02:27:34PM +0200, Alexander Potapenko wrote:
>> It's possible that calling sendfile() to copy the data from a memfd to
>> itself may result in doing a memcpy() with overlapping arguments.
>> To avoid undefined behavior here, replace memcpy() with memmove() and
>> rename memcpy_to_page()/memcpy_from_page() accordingly.
>
> Er...  And what semantics would you assign to such sendfile()?  I really
> want to see details, because it sounds like memmove() here will not be
> any more useful than memcpy() - you still can esily get odd behaviour.


What odd behavior can we get with memmove?

Case that I am thinking of is when you want to delete part of the file
in the middle. To do that you move tail of the file and then truncate.
Memmove will do the intended thing. While memcpy can lost of data and
duplicate another.