linux-kernel - Re: [PATCH v1] PCI: imx6: Handle the abort from user-space

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220223130059.GA28032@lpieralisi>
Date:   Wed, 23 Feb 2022 13:00:59 +0000
From:   Lorenzo Pieralisi <lorenzo.pieralisi@....com>
To:     Francesco Dolcini <francesco.dolcini@...adex.com>
Cc:     Richard Zhu <hongxing.zhu@....com>,
        Lucas Stach <l.stach@...gutronix.de>,
        Rob Herring <robh@...nel.org>,
        Krzysztof Wilczyński <kw@...ux.com>,
        Sascha Hauer <s.hauer@...gutronix.de>,
        Pengutronix Kernel Team <kernel@...gutronix.de>,
        Fabio Estevam <festevam@...il.com>,
        NXP Linux Team <linux-imx@....com>,
        Jason Liu <jason.hui.liu@....com>, linux-pci@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Bjorn Helgaas <bhelgaas@...gle.com>,
        Shawn Guo <shawnguo@...nel.org>
Subject: Re: [PATCH v1] PCI: imx6: Handle the abort from user-space

On Thu, Feb 10, 2022 at 09:00:50AM +0100, Francesco Dolcini wrote:
> Hello Lorenzo,
> just a gently ping on this patch.
> 
> Francesco
> 
> On Mon, Jan 31, 2022 at 08:52:35AM +0100, Francesco Dolcini wrote:
> > From: Jason Liu <jason.hui.liu@....com>
> > 
> > The driver install one hook to handle the external abort, but issue
> > is that if the abort introduced from user space code, the following
> > code unsigned long instr = *(unsigned long *)pc; which will created
> > another data-abort(page domain fault) if CONFIG_CPU_SW_DOMAIN_PAN.
> > 
> > The patch does not intent to use copy_from_user and then do the hack
> > due to the security consideration. In fact, we can just return and
> > report the external abort to user-space.

Apologies for the delay in replying.

This commit log should be rewritten - it is not clear.

Isn't this an issue for all PCI host controllers that install a fault
hook ?

Is this referring to accessing config space directly from user space ?

Can you explain the triggering conditions a bit better please ?

Thanks,
Lorenzo

> > Link: https://lore.kernel.org/all/20220128082920.591115-1-francesco.dolcini@toradex.com
> > Signed-off-by: Jason Liu <jason.hui.liu@....com>
> > Reviewed-by: Richard Zhu <hongxing.zhu@....com>
> > Signed-off-by: Francesco Dolcini <francesco.dolcini@...adex.com>
> > Acked-by: Lucas Stach <l.stach@...gutronix.de>