linux-kernel - Re: [PATCH v6 3/4] rust: uaccess: add typed accessors for userspace pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 18 Apr 2024 21:35:53 +0200
From: Alice Ryhl <aliceryhl@...gle.com>
To: Boqun Feng <boqun.feng@...il.com>
Cc: Benno Lossin <benno.lossin@...ton.me>, Miguel Ojeda <ojeda@...nel.org>, 
	Matthew Wilcox <willy@...radead.org>, Al Viro <viro@...iv.linux.org.uk>, 
	Andrew Morton <akpm@...ux-foundation.org>, Kees Cook <keescook@...omium.org>, 
	Alex Gaynor <alex.gaynor@...il.com>, Wedson Almeida Filho <wedsonaf@...il.com>, Gary Guo <gary@...yguo.net>, 
	Björn Roy Baron <bjorn3_gh@...tonmail.com>, 
	Andreas Hindborg <a.hindborg@...sung.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
	Arve Hjønnevåg <arve@...roid.com>, 
	Todd Kjos <tkjos@...roid.com>, Martijn Coenen <maco@...roid.com>, 
	Joel Fernandes <joel@...lfernandes.org>, Carlos Llamas <cmllamas@...gle.com>, 
	Suren Baghdasaryan <surenb@...gle.com>, Arnd Bergmann <arnd@...db.de>, Trevor Gross <tmgross@...ch.edu>, 
	linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	rust-for-linux@...r.kernel.org, Christian Brauner <brauner@...nel.org>
Subject: Re: [PATCH v6 3/4] rust: uaccess: add typed accessors for userspace pointers

On Thu, Apr 18, 2024 at 7:27 PM Boqun Feng <boqun.feng@...il.com> wrote:
>
> On Thu, Apr 18, 2024 at 04:23:06PM +0000, Benno Lossin wrote:
> > On 18.04.24 15:17, Alice Ryhl wrote:
> > > On Thu, Apr 18, 2024 at 3:02 PM Benno Lossin <benno.lossin@...ton.me> wrote:
> > >>
> > >> On 18.04.24 10:59, Alice Ryhl wrote:
> > >>> diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs
> > >>> index 8fad61268465..9c57c6c75553 100644
> > >>> --- a/rust/kernel/types.rs
> > >>> +++ b/rust/kernel/types.rs
> > >>> @@ -409,3 +409,67 @@ pub enum Either<L, R> {
> > >>>       /// Constructs an instance of [`Either`] containing a value of type `R`.
> > >>>       Right(R),
> > >>>   }
> > >>> +
> > >>> +/// Types for which any bit pattern is valid.
> > >>> +///
> > >>> +/// Not all types are valid for all values. For example, a `bool` must be either zero or one, so
> > >>> +/// reading arbitrary bytes into something that contains a `bool` is not okay.
> > >>> +///
> > >>> +/// It's okay for the type to have padding, as initializing those bytes has no effect.
> > >>> +///
> > >>> +/// # Safety
> > >>> +///
> > >>> +/// All bit-patterns must be valid for this type. This type must not have interior mutability.
> > >>
> > >> What is the reason for disallowing interior mutability here? I agree
> > >> that it is necessary for `AsBytes`, but I don't think we need it here.
>
> Hmm.. technically, if the interior mutability behaves in a way that each
> byte is still initialized during the modification, then it should be
> fine for `AsBytes`, for example and `AtomicI32` (implemented by asm
> blocks)? Not making any change suggestion, just checking my understand.

No, that's UB. When the type is not interior mutable, then any two
loads from the same immutable reference may be assumed to return the
same value. Changing it with an atomic would violate that since the
value changes.

Alice