All of lore.kernel.org
 help / color / mirror / Atom feed
From: Al Viro <viro@zeniv.linux.org.uk>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	linux-fsdevel <linux-fsdevel@vger.kernel.org>
Subject: Re: [PATCH 05/20] tomoyo_write_control(): get rid of pointless access_ok()
Date: Sun, 10 May 2020 04:01:26 +0100	[thread overview]
Message-ID: <20200510030126.GN23230@ZenIV.linux.org.uk> (raw)
In-Reply-To: <CAHk-=wgqyW2ow6yO+yz_0v4aKd162Lwtr24c5nKjZRG-2vW8PA@mail.gmail.com>

On Sat, May 09, 2020 at 05:57:56PM -0700, Linus Torvalds wrote:
> On Sat, May 9, 2020 at 5:51 PM Tetsuo Handa
> <penguin-kernel@i-love.sakura.ne.jp> wrote:
> >
> > I think that this access_ok() check helps reducing partial writes (either
> > "whole amount was processed" or "not processed at all" unless -ENOMEM).
> 
> No it doesn't.
> 
> "access_ok()" only checks the range being a valid user address range.
> 
> It doesn't actually help at all if the worry is "what if we take a
> page fault in the middle".  Because it simply doesn't check those
> kinds of things.
> 
> Now, if somebody passes actual invalid ranges (ie kernel addresses or
> other crazy stuff), they only have themselves to blame. The invalid
> range will be noticed when actually doing the user copy, and then
> you'll get EFAULT there. But there's no point in trying to figure that
> out early - it's only adding overhead, and it doesn't help any normal
> case.

It might be a good idea to add Documentation/what-access_ok-does_not ;-/
In addition to what you've mentioned,

* access_ok() does not fault anything in; never had.

* access_ok() does not verify that memory is readable/writable/there at all;
never had, except for genuine 80386 and (maybe) some of the shittier 486
clones.

* access_ok() does not protect you from the length being insanely large;
even on i386 it can pass with length being a bit under 3Gb.  If you
count upon it to prevent kmalloc() complaints about insanely large
allocation (yes, I've seen that excuse used), you are wrong.

* on a bunch of architectures access_ok() never rejects anything, and
no, that's _not_ MMU-less ones.  sparc64, for example.  Or s390, or
parisc, etc.

  parent reply	other threads:[~2020-05-10  3:01 UTC|newest]

Thread overview: 42+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-09 23:41 [PATCHES] uaccess simple access_ok() removals Al Viro
2020-05-09 23:45 ` [PATCH 01/20] dlmfs_file_write(): get rid of pointless access_ok() Al Viro
2020-05-09 23:45   ` [PATCH 02/20] fat_dir_ioctl(): hadn't needed that access_ok() for more than a decade Al Viro
2020-05-09 23:45   ` [PATCH 03/20] btrfs_ioctl_send(): don't bother with access_ok() Al Viro
2020-05-09 23:45   ` [PATCH 04/20] FIEMAP: " Al Viro
2020-05-10  7:02     ` Christoph Hellwig
2020-05-13 19:02       ` Al Viro
2020-05-13 19:38         ` Christoph Hellwig
2020-05-29 15:01           ` Al Viro
2020-05-09 23:45   ` [PATCH 05/20] tomoyo_write_control(): get rid of pointless access_ok() Al Viro
2020-05-10  0:50     ` Tetsuo Handa
2020-05-10  0:57       ` Linus Torvalds
2020-05-10  1:04         ` Tetsuo Handa
2020-05-10  3:01         ` Al Viro [this message]
2020-05-09 23:45   ` [PATCH 06/20] n_hdlc_tty_read(): remove " Al Viro
2020-05-15 10:53     ` Greg Kroah-Hartman
2020-05-09 23:45   ` [PATCH 07/20] nvram: drop useless access_ok() Al Viro
2020-05-15 10:54     ` Greg Kroah-Hartman
2020-05-09 23:45   ` [PATCH 08/20] cm4000_cs.c cmm_ioctl(): get rid of pointless access_ok() Al Viro
2020-05-09 23:45   ` [PATCH 09/20] drivers/fpga/dfl-fme-pr.c: " Al Viro
2020-05-09 23:45   ` [PATCH 10/20] drivers/fpga/dfl-afu-dma-region.c: " Al Viro
2020-05-09 23:45   ` [PATCH 11/20] amifb: get rid of pointless access_ok() calls Al Viro
2020-05-14 13:45     ` Bartlomiej Zolnierkiewicz
2020-05-14 14:07       ` Al Viro
2020-05-14 14:25         ` Bartlomiej Zolnierkiewicz
2020-05-14 17:41           ` Al Viro
2020-05-14 20:21             ` Geert Uytterhoeven
2020-05-09 23:45   ` [PATCH 12/20] omapfb: " Al Viro
2020-05-14 13:39     ` Bartlomiej Zolnierkiewicz
2020-05-09 23:45   ` [PATCH 13/20] drivers/crypto/ccp/sev-dev.c: get rid of pointless access_ok() Al Viro
2020-05-09 23:45   ` [PATCH 14/20] via-pmu: don't bother with access_ok() Al Viro
2020-05-09 23:45   ` [PATCH 15/20] drm_read(): get rid of pointless access_ok() Al Viro
2020-05-09 23:45   ` [PATCH 16/20] efi_test: " Al Viro
2020-05-09 23:45   ` [PATCH 17/20] lpfc_debugfs: " Al Viro
2020-05-09 23:45   ` [PATCH 18/20] usb: get rid of pointless access_ok() calls Al Viro
2020-05-15 10:53     ` Greg Kroah-Hartman
2020-05-09 23:45   ` [PATCH 19/20] hfi1: get rid of pointless access_ok() Al Viro
2020-05-09 23:45   ` [PATCH 4/4] vmci_host: " Al Viro
2020-05-15 10:53     ` Greg Kroah-Hartman
2020-05-10  0:34 ` [PATCHES] uaccess simple access_ok() removals Linus Torvalds
2020-05-10  3:27   ` Al Viro
2020-05-10 14:34 ` David Laight

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200510030126.GN23230@ZenIV.linux.org.uk \
    --to=viro@zeniv.linux.org.uk \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=penguin-kernel@i-love.sakura.ne.jp \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.