linux-kernel - [PATCH next 3/3] iov: Optimise __import_iovec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250321224557.3847-4-david.laight.linux@gmail.com>
Date: Fri, 21 Mar 2025 22:45:57 +0000
From: David Laight <david.laight.linux@...il.com>
To: linux-kernel@...r.kernel.org
Cc: David Laight <david.laight.linux@...il.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Jens Axboe <axboe@...nel.dk>,
	David Howells <dhowells@...hat.com>,
	Matthew Wilcox <willy@...radead.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Alexander Viro <viro@...iv.linux.org.uk>
Subject: [PATCH next 3/3] iov: Optimise __import_iovec_ubuf()

__import_iovec_ubuf() is used to read a single entry iovec[] into
the simpler 'ubuf' format.
Inline simplified bodies of copy_iovec_from_user() and
copy_compat_iovec_from_user() to avoid the overhead of the loop.

Signed-off-by: David Laight <david.laight.linux@...il.com>
---
I've left in the assignments to iov->iov_base and iov->iov_len
but they may not be needed.

 lib/iov_iter.c | 44 +++++++++++++++++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 9 deletions(-)

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 796ef647bff2..5eff3a307b71 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1437,22 +1437,48 @@ static ssize_t __import_iovec_ubuf(int type, const struct iovec __user *uvec,
 				   struct iovec **iovp, struct iov_iter *i,
 				   bool compat)
 {
+	const struct compat_iovec __user *compat_uvec;
 	struct iovec *iov = *iovp;
-	ssize_t ret;
+	void __user *buf;
+	ssize_t len;
+	int ret;
 
 	*iovp = NULL;
 
-	if (compat)
-		ret = copy_compat_iovec_from_user(iov, uvec, 1);
-	else
-		ret = copy_iovec_from_user(iov, uvec, 1);
-	if (unlikely(ret))
-		return ret;
+	if (can_do_masked_user_access())
+		uvec = masked_user_access_begin(uvec);
+	else if (!user_access_begin(uvec, compat ? sizeof (*compat_uvec) : sizeof (*uvec)))
+		return -EFAULT;
+
+	if (unlikely(compat)) {
+		compat_uvec = (const void __user *)uvec;
+		compat_uptr_t compat_buf;
+		compat_ssize_t compat_len;
+
+		unsafe_get_user(compat_buf, &compat_uvec->iov_base, uaccess_end_efault);
+		unsafe_get_user(compat_len, &compat_uvec->iov_len, uaccess_end_efault);
+		buf = compat_ptr(compat_buf);
+		len = compat_len;
+	} else {
+		unsafe_get_user(buf, &uvec->iov_base, uaccess_end_efault);
+		unsafe_get_user(len, &uvec->iov_len, uaccess_end_efault);
+	}
+	user_access_end();
 
-	ret = import_ubuf(type, iov->iov_base, iov->iov_len, i);
+	/* check for size_t not fitting in ssize_t .. */
+	if (unlikely(len < 0))
+		return -EINVAL;
+
+	iov->iov_base = buf;
+	iov->iov_len = len;
+	ret = import_ubuf(type, buf, len, i);
 	if (unlikely(ret))
 		return ret;
-	return i->count;
+	return len;
+
+uaccess_end_efault:
+	user_access_end();
+	return -EFAULT;
 }
 
 ssize_t __import_iovec(int type, const struct iovec __user *uvec,
-- 
2.39.5