linux-kernel - Re: [PATCH v4 1/3] mm: Add fault_in_subpage_writeable() to probe at sub-page granularity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 23 Apr 2022 16:49:13 -0700
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     Catalin Marinas <catalin.marinas@....com>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Andreas Gruenbacher <agruenba@...hat.com>,
        Josef Bacik <josef@...icpanda.com>,
        Al Viro <viro@...iv.linux.org.uk>, Chris Mason <clm@...com>,
        David Sterba <dsterba@...e.com>, Will Deacon <will@...nel.org>,
        linux-fsdevel@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org, linux-btrfs@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 1/3] mm: Add fault_in_subpage_writeable() to probe at
 sub-page granularity

On Sat, 23 Apr 2022 11:07:49 +0100 Catalin Marinas <catalin.marinas@....com> wrote:

> On hardware with features like arm64 MTE or SPARC ADI, an access fault
> can be triggered at sub-page granularity. Depending on how the
> fault_in_writeable() function is used, the caller can get into a
> live-lock by continuously retrying the fault-in on an address different
> from the one where the uaccess failed.
> 
> In the majority of cases progress is ensured by the following
> conditions:
> 
> 1. copy_to_user_nofault() guarantees at least one byte access if the
>    user address is not faulting.
> 
> 2. The fault_in_writeable() loop is resumed from the first address that
>    could not be accessed by copy_to_user_nofault().
> 
> If the loop iteration is restarted from an earlier (initial) point, the
> loop is repeated with the same conditions and it would live-lock.
> 
> Introduce an arch-specific probe_subpage_writeable() and call it from
> the newly added fault_in_subpage_writeable() function. The arch code
> with sub-page faults will have to implement the specific probing
> functionality.
> 
> Note that no other fault_in_subpage_*() functions are added since they
> have no callers currently susceptible to a live-lock.
> 
> ...
>
> --- a/include/linux/uaccess.h
> +++ b/include/linux/uaccess.h
> @@ -231,6 +231,28 @@ static inline bool pagefault_disabled(void)
>   */
>  #define faulthandler_disabled() (pagefault_disabled() || in_atomic())
>  
> +#ifndef CONFIG_ARCH_HAS_SUBPAGE_FAULTS
> +
> +/**
> + * probe_subpage_writeable: probe the user range for write faults at sub-page
> + *			    granularity (e.g. arm64 MTE)
> + * @uaddr: start of address range
> + * @size: size of address range
> + *
> + * Returns 0 on success, the number of bytes not probed on fault.
> + *
> + * It is expected that the caller checked for the write permission of each
> + * page in the range either by put_user() or GUP. The architecture port can
> + * implement a more efficient get_user() probing if the same sub-page faults
> + * are triggered by either a read or a write.
> + */
> +static inline size_t probe_subpage_writeable(void __user *uaddr, size_t size)

It's `char __user *' at the other definition.

> +{
> +	return 0;
> +}
> +
> +#endif /* CONFIG_ARCH_HAS_SUBPAGE_FAULTS */
> +
>  #ifndef ARCH_HAS_NOCACHE_UACCESS
>  
> ...
>