[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZtjlhFbeFZtxzmTb@telecaster.dhcp.thefacebook.com>
Date: Wed, 4 Sep 2024 15:56:04 -0700
From: Omar Sandoval <osandov@...ndov.com>
To: Christophe Leroy <christophe.leroy@...roup.eu>
Cc: linux-mm@...ck.org, Andrew Morton <akpm@...ux-foundation.org>,
Benjamin Gray <bgray@...ux.ibm.com>,
"Christopher M. Riedl" <cmr@...escreens.de>,
Christoph Hellwig <hch@....de>, x86@...nel.org,
linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
loongarch@...ts.linux.dev, linux-mips@...r.kernel.org,
linux-parisc@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
linux-um@...ts.infradead.org, kernel-team@...com
Subject: Re: [PATCH 2/2] mm: make copy_to_kernel_nofault() not fault on user
addresses
On Wed, Sep 04, 2024 at 09:50:56AM +0200, Christophe Leroy wrote:
> Hi,
>
> Le 02/09/2024 à 07:31, Omar Sandoval a écrit :
> > [Vous ne recevez pas souvent de courriers de osandov@...ndov.com. Découvrez pourquoi ceci est important à https://aka.ms/LearnAboutSenderIdentification ]
> >
> > From: Omar Sandoval <osandov@...com>
> >
> > I found that on x86, copy_to_kernel_nofault() still faults on addresses
> > outside of the kernel address range (including NULL):
> >
> > # echo ttyS0 > /sys/module/kgdboc/parameters/kgdboc
> > # echo g > /proc/sysrq-trigger
> > ...
> > [15]kdb> mm 0 1234
> > [ 94.652476] BUG: kernel NULL pointer dereference, address: 0000000000000000
> ...
> >
> > Note that copy_to_kernel_nofault() uses pagefault_disable(), but it
> > still faults. This is because with Supervisor Mode Access Prevention
> > (SMAP) enabled, do_user_addr_fault() Oopses on a fault for a user
> > address from kernel space _before_ checking faulthandler_disabled().
> >
> > copy_from_kernel_nofault() avoids this by checking that the address is
> > in the kernel before doing the actual memory access. Do the same in
> > copy_to_kernel_nofault() so that we get an error as expected:
> >
> > # echo ttyS0 > /sys/module/kgdboc/parameters/kgdboc
> > # echo g > /proc/sysrq-trigger
> > ...
> > [17]kdb> mm 0 1234
> > kdb_putarea_size: Bad address 0x0
> > diag: -21: Invalid address
> >
> > Signed-off-by: Omar Sandoval <osandov@...com>
> > ---
> > mm/maccess.c | 3 +++
> > 1 file changed, 3 insertions(+)
> >
> > diff --git a/mm/maccess.c b/mm/maccess.c
> > index 72e9c03ea37f..d67dee51a1cc 100644
> > --- a/mm/maccess.c
> > +++ b/mm/maccess.c
> > @@ -61,6 +61,9 @@ long copy_to_kernel_nofault(void *dst, const void *src, size_t size)
> > if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
> > align = (unsigned long)dst | (unsigned long)src;
> >
> > + if (!copy_kernel_nofault_allowed(dst, size))
> > + return -ERANGE;
> > +
> > pagefault_disable();
> > if (!(align & 7))
> > copy_to_kernel_nofault_loop(dst, src, size, u64, Efault);
> > --
> > 2.46.0
> >
>
> This patch leads to the following errors on ppc64le_defconfig:
>
> [ 2.423930][ T1] Running code patching self-tests ...
> [ 2.428912][ T1] code-patching: test failed at line 395
> [ 2.429085][ T1] code-patching: test failed at line 398
> [ 2.429561][ T1] code-patching: test failed at line 432
> [ 2.429679][ T1] code-patching: test failed at line 435
>
> This seems to be linked to commit c28c15b6d28a ("powerpc/code-patching: Use
> temporary mm for Radix MMU"), copy_from_kernel_nofault_allowed() returns
> false for the patching area.
Thanks for testing. This patch isn't worth the trouble, so we can drop
it.
Thanks,
Omar
Powered by blists - more mailing lists