linux-kernel - Re: [PATCH v4.19.x] make 'user_access_begin()' do 'access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <89DE19F6-4CB0-4324-A630-C8574C8D591C@vmware.com>
Date:   Wed, 13 May 2020 06:13:17 +0000
From:   Ashwin H <ashwinh@...are.com>
To:     Greg KH <gregkh@...uxfoundation.org>
CC:     "x86@...nel.org" <x86@...nel.org>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "intel-gfx@...ts.freedesktop.org" <intel-gfx@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...nel.org" <stable@...nel.org>,
        Srivatsa Bhat <srivatsab@...are.com>,
        "srivatsa@...il.mit.edu" <srivatsa@...il.mit.edu>,
        "rostedt@...dmis.org" <rostedt@...dmis.org>,
        Steven Rostedt <srostedt@...are.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH v4.19.x] make 'user_access_begin()' do 'access_ok()'

This patch fixes CVE-2018-20669 in 4.19 tree.

On 13/05/20, 11:36 AM, "Greg KH" <gregkh@...uxfoundation.org> wrote:

    On Wed, May 13, 2020 at 07:19:21AM +0530, ashwin-h wrote:
    > From: Linus Torvalds <torvalds@...ux-foundation.org>
    > 
    > commit 594cc251fdd0d231d342d88b2fdff4bc42fb0690 upstream.
    > 
    > Originally, the rule used to be that you'd have to do access_ok()
    > separately, and then user_access_begin() before actually doing the
    > direct (optimized) user access.
    > 
    > But experience has shown that people then decide not to do access_ok()
    > at all, and instead rely on it being implied by other operations or
    > similar.  Which makes it very hard to verify that the access has
    > actually been range-checked.
    > 
    > If you use the unsafe direct user accesses, hardware features (either
    > SMAP - Supervisor Mode Access Protection - on x86, or PAN - Privileged
    > Access Never - on ARM) do force you to use user_access_begin().  But
    > nothing really forces the range check.
    > 
    > By putting the range check into user_access_begin(), we actually force
    > people to do the right thing (tm), and the range check vill be visible
    > near the actual accesses.  We have way too long a history of people
    > trying to avoid them.
    > 
    > Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
    > Signed-off-by: Ashwin H <ashwinh@...are.com>
    > ---
    >  arch/x86/include/asm/uaccess.h             | 11 ++++++++++-
    >  drivers/gpu/drm/i915/i915_gem_execbuffer.c | 15 +++++++++++++--
    >  include/linux/uaccess.h                    |  2 +-
    >  kernel/compat.c                            |  6 ++----
    >  kernel/exit.c                              |  6 ++----
    >  lib/strncpy_from_user.c                    |  9 +++++----
    >  lib/strnlen_user.c                         |  9 +++++----
    >  7 files changed, 38 insertions(+), 20 deletions(-)
    
    Are you wanting this merged to a specific stable kernel tree?  If so, why?
    
    thanks,
    
    greg k-h