linux-kernel - Re: [PATCH v2] mm/gup: fix FOLL_FORCE COW security issue and remove FOLL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b314c287-5fc2-9f61-53f6-33282a2bed92@redhat.com>
Date:   Wed, 10 Aug 2022 11:18:16 +0200
From:   David Hildenbrand <david@...hat.com>
To:     David Laight <David.Laight@...LAB.COM>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc:     "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Axel Rasmussen <axelrasmussen@...gle.com>,
        Nadav Amit <nadav.amit@...il.com>,
        Peter Xu <peterx@...hat.com>, Hugh Dickins <hughd@...gle.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Matthew Wilcox <willy@...radead.org>,
        Vlastimil Babka <vbabka@...e.cz>,
        John Hubbard <jhubbard@...dia.com>,
        Jason Gunthorpe <jgg@...dia.com>
Subject: Re: [PATCH v2] mm/gup: fix FOLL_FORCE COW security issue and remove
 FOLL_COW

On 10.08.22 11:12, David Laight wrote:
> From: David Hildenbrand
>> Sent: 09 August 2022 21:57
> ...
> 
> These two functions seem to contain a lot of the same tests.

Yes, but after Linus and I discussed to not even reuse is_cow_mapping()
but instead to spell it out, I refrained from factoring common checks
out here to harm readability.

[...]

> 
> Perhaps only the initial call (common success path?) should
> be inlined?
> With the flags and vma tests being moved to an inline helper.

Do we really care enough to hurt readability? I mean, most things here
are simple bit checks, not expensive function calls.

inline is only a hint to the compiler after all. Please correct me if
I'm wrong.


Now, I don't have any strong opinion, but I do want to make progress for
this because -stable trees still need fixing and I'll be posting the
reproducer on Monday.


Thanks

-- 
Thanks,

David / dhildenb