From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Lutomirski Subject: Re: [kernel-hardening] Re: [PATCH v9 1/4] syscalls: Verify address limit before returning to user-mode Date: Fri, 12 May 2017 16:20:31 -0700 Message-ID: References: <20170428153213.137279-1-thgarnie@google.com> <20170508073352.caqe3fqf7nuxypgi@gmail.com> <20170508124621.GA20705@kroah.com> <20170509064522.anusoikaalvlux3w@gmail.com> <20170509085659.GA32555@infradead.org> <20170512070012.7dysuhbkcas7ibaj@gmail.com> <20170512071549.GP390@ZenIV.linux.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Return-path: In-Reply-To: <20170512071549.GP390-3bDd1+5oDREiFSDQTTA3OLVCufUGDwFn@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Al Viro Cc: Ingo Molnar , Andy Lutomirski , Christoph Hellwig , Greg KH , Thomas Garnier , Martin Schwidefsky , Heiko Carstens , Dave Hansen , Arnd Bergmann , Thomas Gleixner , David Howells , =?UTF-8?Q?Ren=C3=A9_Nyffenegger?= , Andrew Morton , "Paul E . McKenney" , "Eric W . Biederman" , Oleg Nesterov , Pavel Tikhomirov , Ingo Molnar , "H . Peter Anvin" , Paolo List-Id: linux-api@vger.kernel.org On Fri, May 12, 2017 at 12:15 AM, Al Viro wrote: > Folks, seriously, have you even looked through that zoo? I have, and it's > really, really not fun. Sure, we can say "fuck 'em, no need to allow > splice() on random crap". Would be perfectly reasonable, expect that > it's not the only place doing kernel_write() and its ilk... Can you clarify this? I think we really may be able to do exactly this. From Christoph's list, there are only two things that need kernel_read/kernel_write to user-supplied fds that may come from a variety of sources: splice and exec. If you're execing a chardev from a crappy driver, something is seriously wrong. And returning -EINVAL from splice() to or from files that use ->read and ->write seems find (and splice(2) even documents -EINVAL as meaning that the target doesn't support splicing). --Andy