linux-kernel - RE: [PATCH v4 1/3] x86/mce: Use is_copy_from_user() to determine copy-from-user context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <SJ1PR11MB6083654405F2721E5AA0C1F2FCD52@SJ1PR11MB6083.namprd11.prod.outlook.com>
Date: Fri, 7 Mar 2025 22:05:12 +0000
From: "Luck, Tony" <tony.luck@...el.com>
To: Borislav Petkov <bp@...en8.de>, Shuai Xue <xueshuai@...ux.alibaba.com>
CC: "peterz@...radead.org" <peterz@...radead.org>, "catalin.marinas@....com"
	<catalin.marinas@....com>, "yazen.ghannam@....com" <yazen.ghannam@....com>,
	"akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
	"linmiaohe@...wei.com" <linmiaohe@...wei.com>, "nao.horiguchi@...il.com"
	<nao.horiguchi@...il.com>, "tglx@...utronix.de" <tglx@...utronix.de>,
	"mingo@...hat.com" <mingo@...hat.com>, "dave.hansen@...ux.intel.com"
	<dave.hansen@...ux.intel.com>, "x86@...nel.org" <x86@...nel.org>,
	"hpa@...or.com" <hpa@...or.com>, "jpoimboe@...nel.org" <jpoimboe@...nel.org>,
	"linux-edac@...r.kernel.org" <linux-edac@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>, "baolin.wang@...ux.alibaba.com"
	<baolin.wang@...ux.alibaba.com>, "tianruidong@...ux.alibaba.com"
	<tianruidong@...ux.alibaba.com>
Subject: RE: [PATCH v4 1/3] x86/mce: Use is_copy_from_user() to determine
 copy-from-user context

> The more important part which I asked for already is, is is_copy_from_user()
> exhaustive in determining the that the operation really is a copy from user?
>
> The EX_TYPE_UACCESS things *explicitly* marked such places in the code. Does
> is_copy_from_user() guarantee the same, without false positives?

is_copy_from_user() decodes the instruction that took the trap. It looks for
MOV, MOVZ and MOVS instructions to find the source address, and then
checks whether that's user (< TASK_SIZE_MAX) or kernel.

So no false positives.

There could be some false negatives if some other instruction is doing
the "load" operation.

-Tony