linux-kernel - Re: [Bug report] hash_name() may cross page boundary and trigger

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251129040817.65356-1-xieyuanbin1@huawei.com>
Date: Sat, 29 Nov 2025 12:08:17 +0800
From: Xie Yuanbin <xieyuanbin1@...wei.com>
To: <torvalds@...ux-foundation.org>, <will@...nel.org>,
	<linux@...linux.org.uk>, <viro@...iv.linux.org.uk>, <bigeasy@...utronix.de>,
	<rmk+kernel@...linux.org.uk>
CC: <akpm@...ux-foundation.org>, <brauner@...nel.org>,
	<catalin.marinas@....com>, <hch@....de>, <jack@...e.com>,
	<linux-arm-kernel@...ts.infradead.org>, <linux-fsdevel@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <linux-mm@...ck.org>,
	<pangliyuan1@...wei.com>, <wangkefeng.wang@...wei.com>,
	<wozizhi@...weicloud.com>, <xieyuanbin1@...wei.com>, <yangerkun@...wei.com>,
	<lilinjie8@...wei.com>, <liaohua4@...wei.com>
Subject: Re: [Bug report] hash_name() may cross page boundary and trigger

On Fri, 28 Nov 2025 17:35:37 -0800, Linus Torvalds wrote:
> On Fri, 28 Nov 2025 at 17:01, Zizhi Wo <wozizhi@...weicloud.com> wrote:
>> It has an additional check to determine reg:
>>
>> if (unlikely(addr > TASK_SIZE) && !user_mode(regs))
>>         goto no_context;
>>
>> I'd like to ask if this "regs" examination also needs to be brought
>> along?
>
> That seems unnecessary.
>
> Yes, in this case the original problem you reported with sleeping in
> an RCU region was triggered by a kernel access, and a user-space
> access would never have caused any such issues.
>
> So checking for !user_mode(regs) isn't exactly *wrong*.
>
> But while it isn't wrong, I think it's also kind of pointless.
>
> Because regardless of whether it's a kernel or user space access, an
> access outside TASK_SIZE shouldn't be associated with a valid user
> space context, so the code might as well just go to the "no_context"
> label directly.
>
> That said, somebody should  definitely double-check me - because I
> think arm also did the vdso trick at high addresses that i386 used to
> do, so there is the fake VDSO thing up there.
>
> But if you get a page fault on that, it's not going to be fixed up, so
> even if user space can access it, there's no point in looking that
> fake vm area up for page faults.

I think the `user_mode(regs)` check is necessary because the label
no_context actually jumps to __do_kernel_fault(), whereas page fault
from user mode should jump to `__do_user_fault()`.

Alternatively, we would need to change `goto no_context` to
`goto bad_area`. Or perhaps I misunderstood something, please point it out.

Thanks very much!

Xie Yuanbin