linux-kernel - Re: [RFC PATCH v1 01/10] s390/uaccess: Add storage key checked access to user memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YerCfDceDszqbdHU@osiris>
Date:   Fri, 21 Jan 2022 15:26:04 +0100
From:   Heiko Carstens <hca@...ux.ibm.com>
To:     Janis Schoetterl-Glausch <scgl@...ux.ibm.com>
Cc:     Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Nico Boehr <nrb@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        linux-s390@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH v1 01/10] s390/uaccess: Add storage key checked
 access to user memory

On Fri, Jan 21, 2022 at 02:46:02PM +0100, Janis Schoetterl-Glausch wrote:
> >> +static inline __must_check unsigned long
> >> +_copy_from_user_key(void *to, const void __user *from, unsigned long n, u8 key)
> > 
> > Make key unsigned long, add support for INLINE_COPY_TO_USER, and maybe
> > add a wrapper, so this works on all architectures, e.g. if
> > raw_copy_to_user_key() is not defined, then fall back to
> > raw_copy_to_user() and ignore the key parameter.
> > 
> 
> Since we only need the double underscore variants, even if we're going to be more
> general than we need to be, we can restrict ourselves to those, can't we?

I don't think that works with INLINE_COPY_TO_USER. The reason for the
single underline variants is being able to have an out-line-implementation
in lib/usercopy.c, isn't it?

> I don't understand your comment about the wrapper. You'd want an error on misuse,
> that is, if you try to use a _with_key function if the functionality is not defined, no?

No. My intention was that it should simply work/compile by default for
architectures which do not support a key mechanism:

something like

#ifndef raw_copy_to_user_key
static inline unsigned long raw_copy_to_user_key(..., unsigned long key)
{
	return raw_copy_to_user(...);
}
#endif

Again, this is just a proposal and might be turned down by common code
guys. Just trying to come up with something which could also work on other
architectures, and which does not cause pain because architectures don't
really need it.