linux-kernel - Re: [git pull] vfs.git pile 11

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170706212014.GZ10672@ZenIV.linux.org.uk>
Date:   Thu, 6 Jul 2017 22:20:14 +0100
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Kees Cook <keescook@...omium.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        LKML <linux-kernel@...r.kernel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [git pull] vfs.git pile 11

On Thu, Jul 06, 2017 at 09:29:27PM +0100, Al Viro wrote:
> On Thu, Jul 06, 2017 at 09:18:26PM +0100, Al Viro wrote:
> > On Thu, Jul 06, 2017 at 12:45:36PM -0700, Kees Cook wrote:
> > > 
> > > +   if (unlikely(!check_copy_size(addr, bytes, false)))
> > > +       return false;
> > > +   else
> > > +       return _copy_from_iter_full(addr, bytes, i);
> > > 
> > > Can these be rewritten to avoid the double-negative?
> > 
> > Matter of taste - I've no strong preferences here.
> > 
> > > +   might_fault();
> > > 
> > > Should this be might_sleep()? Just from reading the patch it looked
> > > like you were adding might_sleep()s in the other cases.
> > 
> > D'oh - shouldn't have written that pull request message before the
> > first cup of coffee...  might_sleep() it is, of course.
> 
> Hrm...  Said that, might_sleep() doesn't check one thing might_fault()
> does - the
> #if defined(CONFIG_DEBUG_ATOMIC_SLEEP)
>         if (current->mm)
>                 might_lock_read(&current->mm->mmap_sem);
> #endif
> thing.  Let me think a bit...

FWIW,
	* with iovec-backed, any of those primitives under pagefault_disable()
is seriously wrong.  To the point where we probably want to complain when
called that way.  That, of course, needs to be checked at the outermost level -
the primitives might do pagefault_disable() internally; that's fine.  Outside
caller doing that under pagefault_disable() isn't.
	* uaccess_kernel() (== set_fs(KERNEL_DS)) has nothing to do with it.
If anything, we should not do copyin/copyout on iovec-backed ones with that
present.
	* telling lockdep that we might end up grabbing ->mm->mmap_sem, OTOH,
is the right thing to do.  In addition to might_sleep().

Linus, could you hold that one back until tomorrow?  I want to tweak the
last commit in there a bit, but I want to give it a local beating first...