linux-kernel - Re: [PATCH v1 2/2] epoll: Use __user_write_access_begin() and unsafe_put_user() in epoll_put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0bfa4895-727b-407b-90d2-7d54b9bd4910@intel.com>
Date: Thu, 23 Oct 2025 12:40:59 -0700
From: Dave Hansen <dave.hansen@...el.com>
To: Kuniyuki Iwashima <kuniyu@...gle.com>,
 Catalin Marinas <catalin.marinas@....com>, Will Deacon <will@...nel.org>,
 Madhavan Srinivasan <maddy@...ux.ibm.com>,
 Michael Ellerman <mpe@...erman.id.au>, Paul Walmsley <pjw@...nel.org>,
 Palmer Dabbelt <palmer@...belt.com>, Albert Ou <aou@...s.berkeley.edu>,
 Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>,
 Jens Axboe <axboe@...nel.dk>, Christian Brauner <brauner@...nel.org>,
 Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Nicholas Piggin <npiggin@...il.com>,
 Christophe Leroy <christophe.leroy@...roup.eu>,
 Alexandre Ghiti <alex@...ti.fr>, "H. Peter Anvin" <hpa@...or.com>,
 Eric Dumazet <edumazet@...gle.com>, Kuniyuki Iwashima <kuni1840@...il.com>,
 x86@...nel.org, linux-arm-kernel@...ts.infradead.org,
 linuxppc-dev@...ts.ozlabs.org, linux-riscv@...ts.infradead.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 2/2] epoll: Use __user_write_access_begin() and
 unsafe_put_user() in epoll_put_uevent().

On 10/22/25 17:04, Kuniyuki Iwashima wrote:
> --- a/include/linux/eventpoll.h
> +++ b/include/linux/eventpoll.h
> @@ -82,11 +82,14 @@ static inline struct epoll_event __user *
>  epoll_put_uevent(__poll_t revents, __u64 data,
>  		 struct epoll_event __user *uevent)
>  {
> -	if (__put_user(revents, &uevent->events) ||
> -	    __put_user(data, &uevent->data))
> -		return NULL;
> -
> -	return uevent+1;
> +	__user_write_access_begin(uevent, sizeof(*uevent));
> +	unsafe_put_user(revents, &uevent->events, efault);
> +	unsafe_put_user(data, &uevent->data, efault);
> +	user_access_end();
> +	return uevent + 1;
> +efault:
> +	user_access_end();
> +	return NULL;
>  }
>  #endif

This makes me nervous. The access_ok() check is quite a distance away.
I'd kinda want to see some performance numbers before doing this. Is
removing a single access_ok() even measurable?

Also, even if we go do this, shouldn't __user_write_access_begin() be
called something more like unsafe_user_write_access_begin()?