From: Arnd Bergmann <arnd-r2nGTMty4D4@public.gmane.org>
To: Johannes Berg <johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>
Cc: linux-nvme-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org,
Sean Young <sean-hENCXIMQXOg@public.gmane.org>,
linux-iio-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
Daniel Vetter <daniel.vetter-/w4YWyX8dFk@public.gmane.org>,
linux-pci <linux-pci-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
dri-devel
<dri-devel-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org>,
Bjorn Andersson
<bjorn.andersson-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org>,
sparclinux <sparclinux-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
Mauro Carvalho Chehab
<mchehab+samsung-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>,
driverdevel
<devel-gWbeCf7V1WCQmaza687I9mD2FQJk+8+b@public.gmane.org>,
linux-scsi <linux-scsi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
linux-nvdimm-hn68Rpc1hR1g9hUCZPvPmw@public.gmane.org,
y2038 Mailman List
<y2038-cunTk1MwBs8s++Sfvej+rw@public.gmane.org>,
qat-linux-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org,
amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org,
Jason Gunthorpe <jgg-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>,
"open list:HID CORE LAYER"
<linux-input-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
Darren Hart <dvhart-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org>,
Linux Media Mailing List
<linux-media-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
linux-remoteproc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linaro-mm-sig-cunTk1MwBs8s++Sfvej+rw@public.gmane.org,
Al Viro <viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org>,
Jonathan Cameron <Jonathan.Cameron@h>
Subject: Re: [PATCH v3 12/26] compat_ioctl: move more drivers to compat_ptr_ioctl
Date: Fri, 26 Apr 2019 09:46:13 +0200 [thread overview]
Message-ID: <CAK8P3a3CzKLvpUiVV_k__kkaZ=wg2fqnFEzWYL9qNwBfxMKZ9w@mail.gmail.com> (raw)
In-Reply-To: <5511420228cb38d08a67c0f6a614b7671d7d23d4.camel-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>
On Thu, Apr 25, 2019 at 11:25 PM Johannes Berg
<johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org> wrote:
> On Thu, 2019-04-25 at 17:55 +0200, Arnd Bergmann wrote:
> > On Thu, Apr 25, 2019 at 5:35 PM Al Viro <viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org> wrote:
> > >
> > > On Thu, Apr 25, 2019 at 12:21:53PM -0300, Mauro Carvalho Chehab wrote:
> > >
> > > > If I understand your patch description well, using compat_ptr_ioctl
> > > > only works if the driver is not for s390, right?
> > >
> > > No; s390 is where "oh, just set ->compat_ioctl same as ->unlocked_ioctl
> > > and be done with that; compat_ptr() is a no-op anyway" breaks. IOW,
> > > s390 is the reason for having compat_ptr_ioctl() in the first place;
> > > that thing works on all biarch architectures, as long as all stuff
> > > handled by ->ioctl() takes pointer to arch-independent object as
> > > argument. IOW,
> > > argument ignored => OK
> > > any arithmetical type => no go, compat_ptr() would bugger it
> > > pointer to int => OK
> > > pointer to string => OK
> > > pointer to u64 => OK
> > > pointer to struct {u64 addr; char s[11];} => OK
> >
> > To be extra pedantic, the 'struct {u64 addr; char s[11];} '
> > case is also broken on x86, because sizeof (obj) is smaller
> > on i386, even though the location of the members are
> > the same. i.e. you can copy_from_user() this
>
> Actually, you can't even do that because the struct might sit at the end
> of a page and then you'd erroneously fault in this case.
>
> We had this a while ago with struct ifreq, see commit 98406133dd and its
> parents.
Yes, you are right. Very rare to hit with real-life code, but easily
reproduced by intentionally hitting it and clearly a bug.
As the saying goes
| the difference between "always works" and "almost always works"
| is called data corruption
here the difference is an -EFAULT.
Arnd
next prev parent reply other threads:[~2019-04-26 7:46 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-16 20:19 [PATCH v3 00/26] compat_ioctl: cleanups Arnd Bergmann
2019-04-16 20:19 ` [PATCH v3 09/26] compat_ioctl: move drivers to compat_ptr_ioctl Arnd Bergmann
2019-04-16 20:31 ` Jiri Kosina
2019-04-18 11:10 ` Stefan Hajnoczi
2019-04-19 23:16 ` Michael S. Tsirkin
2019-04-20 8:03 ` Winkler, Tomas
[not found] ` <20190416202013.4034148-1-arnd-r2nGTMty4D4@public.gmane.org>
2019-04-16 20:25 ` [PATCH v3 12/26] compat_ioctl: move more " Arnd Bergmann
2019-04-25 15:21 ` Mauro Carvalho Chehab
2019-04-25 15:32 ` Arnd Bergmann
2019-04-25 15:35 ` Al Viro
2019-04-25 15:53 ` Mauro Carvalho Chehab
[not found] ` <20190425153534.GS2217-3bDd1+5oDREiFSDQTTA3OLVCufUGDwFn@public.gmane.org>
2019-04-25 15:55 ` Arnd Bergmann
2019-04-25 16:42 ` Al Viro
[not found] ` <CAK8P3a2HmiYQJ2FV2FgLiFsD8M9UKteC9Jetx7ja06PQVZWYfA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2019-04-25 21:25 ` Johannes Berg
[not found] ` <5511420228cb38d08a67c0f6a614b7671d7d23d4.camel-cdvu00un1VgdHxzADdlk8Q@public.gmane.org>
2019-04-26 7:46 ` Arnd Bergmann [this message]
2019-04-16 22:33 ` [PATCH v3 00/26] compat_ioctl: cleanups Douglas Gilbert
2019-04-17 9:26 ` Arnd Bergmann
2019-05-06 9:03 ` Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAK8P3a3CzKLvpUiVV_k__kkaZ=wg2fqnFEzWYL9qNwBfxMKZ9w@mail.gmail.com' \
--to=arnd-r2ngtmty4d4@public.gmane.org \
--cc=Jonathan.Cameron@h \
--cc=amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org \
--cc=bjorn.andersson-QSEj5FYQhm4dnm+yROfE0A@public.gmane.org \
--cc=daniel.vetter-/w4YWyX8dFk@public.gmane.org \
--cc=devel-gWbeCf7V1WCQmaza687I9mD2FQJk+8+b@public.gmane.org \
--cc=dri-devel-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org \
--cc=dvhart-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org \
--cc=jgg-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org \
--cc=johannes-cdvu00un1VgdHxzADdlk8Q@public.gmane.org \
--cc=linaro-mm-sig-cunTk1MwBs8s++Sfvej+rw@public.gmane.org \
--cc=linux-iio-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-input-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-media-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-nvdimm-hn68Rpc1hR1g9hUCZPvPmw@public.gmane.org \
--cc=linux-nvme-IAPFreCvJWM7uuMidbF8XUB+6BGkLq7r@public.gmane.org \
--cc=linux-pci-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-remoteproc-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-scsi-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=mchehab+samsung-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=qat-linux-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org \
--cc=sean-hENCXIMQXOg@public.gmane.org \
--cc=sparclinux-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org \
--cc=y2038-cunTk1MwBs8s++Sfvej+rw@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).