linux-kernel - Re: user_access_{save,restore}() semantics

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200710164037.GV597537@hirez.programming.kicks-ass.net>
Date:   Fri, 10 Jul 2020 18:40:37 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Christoph Hellwig <hch@....de>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: user_access_{save,restore}() semantics

On Fri, Jul 10, 2020 at 06:15:27PM +0200, Christoph Hellwig wrote:
> Hi Peter,
> 
> can you explain (and maybe document while we're at it) what the
> exact semantics of the user_access_{save,restore} helpers are?
> 
> Reverse engineering from the commit text they seem to be about
> saving the current uaccess state.  But do they also enable/disable
> anything?

user_access_save() is like local_irq_save(), it stores the EFLAGS and
clears AC/IF resp. user_access_restore(), like local_irq_restore(),
simply restores the previously saved EFLAGS.

So for code that had user_access_begin(),
user_access_save()/user_access_restore() will temporarily disable
user-access and allow calling other code.

something like so?

---
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 0a76ddc07d59..c4fadefdb9b2 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -336,7 +336,25 @@ long strnlen_user_nofault(const void __user *unsafe_addr, long count);
 #define unsafe_get_user(x,p,e) unsafe_op_wrap(__get_user(x,p),e)
 #define unsafe_put_user(x,p,e) unsafe_op_wrap(__put_user(x,p),e)
 #define unsafe_copy_to_user(d,s,l,e) unsafe_op_wrap(__copy_to_user(d,s,l),e)
+
+/*
+ * user_access_save(): save current user-access state and disable
+ *
+ * Similar to local_irq_save(), which saves IRQ state and disables
+ * IRQs, exceppt for user-access state.
+ *
+ * Returns a value to be used only by user_access_restore() to
+ * restore the user-access state.
+ */
 static inline unsigned long user_access_save(void) { return 0UL; }
+
+/*
+ * user_access_restore(): restore a previous user-access state
+ * @flags: value obtained from a prevous user_access_save() call
+ *
+ * Similar to local_irq_restore(), which restores a previously saved
+ * IRQ state, except for user-access state.
+ */
 static inline void user_access_restore(unsigned long flags) { }
 #endif
 #ifndef user_write_access_begin