Linux-MIPS Archive on lore.kernel.org
 help / color / Atom feed
From: David Laight <David.Laight@ACULAB.COM>
To: 'Paul Burton' <paulburton@kernel.org>
Cc: "linux-mips@vger.kernel.org" <linux-mips@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: RE: [PATCH] MIPS: Use __copy_{to,from}_user() for emulated FP loads/stores
Date: Wed, 4 Dec 2019 16:18:52 +0000
Message-ID: <e220ba9a19da41abba599b5873afa494@AcuMS.aculab.com> (raw)
In-Reply-To: <20191204154048.eotzglp4rdlx4yzl@lantea.localdomain>

From: Paul Burton
> Sent: 04 December 2019 15:41
> On Wed, Dec 04, 2019 at 11:14:08AM +0000, David Laight wrote:
> > From: Paul Burton
> > > Sent: 03 December 2019 20:50
> > > Our FPU emulator currently uses __get_user() & __put_user() to perform
> > > emulated loads & stores. This is problematic because __get_user() &
> > > __put_user() are only suitable for naturally aligned memory accesses,
> > > and the address we're accessing is entirely under the control of
> > > userland.
> > >
> > > This allows userland to cause a kernel panic by simply performing an
> > > unaligned floating point load or store - the kernel will handle the
> > > address error exception by attempting to emulate the instruction, and in
> > > the process it may generate another address error exception itself.
> > > This time the exception is taken with EPC pointing at the kernels FPU
> > > emulation code, and we hit a die_if_kernel() in
> > > emulate_load_store_insn().
> >
> > Won't this be true of almost all code that uses get_user() and put_user()
> > (with or without the leading __).
> 
> Only if the address being accessed is under the control of userland to
> the extent that it can create an unaligned address. You're right that
> may be more widespread though; it needs checking...

Look at (for example) the recvmmsg() code or epoll_wait().

I'd expect all get/put_user() to be potentially unaligned.
The user might have to try hard (to avoid all the faults in userspace)
but any buffer passed to the kernel can potentially be misaligned and
nothing (I've seen) is documented as returning EFAULT/SIGSEGV
for such unaligned buffers.

In 'days of yore...' SPARC systems would have done a SIGSEGV for
any misaligned access in userspace.
Not sure why Linux ever thought it was necessary to 'fixup' such faults.
OTOH it is too late to change that behaviour (at least for existing ports).

> We used to have separate get_user_unaligned() & put_user_unaligned()
> which would suggest that it's expected that get_user() & put_user()
> require their accesses be aligned, but they were removed by commit
> 3170d8d226c2 ("kill {__,}{get,put}_user_unaligned()") in v4.13.
> 
> But perhaps we should just take the second AdEL exception & recover via
> the fixups table. We definitely don't right now... Needs further
> investigation...

get/put_user can fault because the user page is absent (etc).
So there must be code to 'expect' a fault on those instructions.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)

      reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-12-03 20:49 Paul Burton
2019-12-04 11:14 ` David Laight
2019-12-04 15:40   ` Paul Burton
2019-12-04 16:18     ` David Laight [this message]

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=e220ba9a19da41abba599b5873afa494@AcuMS.aculab.com \
    --to=david.laight@aculab.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mips@vger.kernel.org \
    --cc=paulburton@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-MIPS Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-mips/0 linux-mips/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-mips linux-mips/ https://lore.kernel.org/linux-mips \
		linux-mips@vger.kernel.org
	public-inbox-index linux-mips

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-mips


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git