From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 313A2C433FE for ; Sat, 5 Dec 2020 08:48:11 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4EDAE22DBF for ; Sat, 5 Dec 2020 08:48:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4EDAE22DBF Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=lst.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 84CB66B005D; Sat, 5 Dec 2020 03:48:09 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 7D7566B0068; Sat, 5 Dec 2020 03:48:09 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6EBFC6B006C; Sat, 5 Dec 2020 03:48:09 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0102.hostedemail.com [216.40.44.102]) by kanga.kvack.org (Postfix) with ESMTP id 53FDE6B005D for ; Sat, 5 Dec 2020 03:48:09 -0500 (EST) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 1DA9D8249980 for ; Sat, 5 Dec 2020 08:48:09 +0000 (UTC) X-FDA: 77558601498.28.coat15_3d130d0273cb Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin28.hostedemail.com (Postfix) with ESMTP id E9CA36D76 for ; Sat, 5 Dec 2020 08:48:08 +0000 (UTC) X-HE-Tag: coat15_3d130d0273cb X-Filterd-Recvd-Size: 3901 Received: from verein.lst.de (verein.lst.de [213.95.11.211]) by imf01.hostedemail.com (Postfix) with ESMTP for ; Sat, 5 Dec 2020 08:48:08 +0000 (UTC) Received: by verein.lst.de (Postfix, from userid 2407) id D673B6736F; Sat, 5 Dec 2020 09:48:04 +0100 (CET) Date: Sat, 5 Dec 2020 09:48:04 +0100 From: Christoph Hellwig To: Christophe Leroy Cc: Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , hch@lst.de, viro@zeniv.linux.org.uk, akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-mm@kvack.org, Linus Torvalds Subject: Re: [PATCH] powerpc/mm: Fix KUAP warning by providing copy_from_kernel_nofault_allowed() Message-ID: <20201205084804.GA25452@lst.de> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.17 (2007-11-01) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sat, Dec 05, 2020 at 08:43:06AM +0000, Christophe Leroy wrote: > Since commit c33165253492 ("powerpc: use non-set_fs based maccess > routines"), userspace access is not granted anymore when using > copy_from_kernel_nofault() > > However, kthread_probe_data() uses copy_from_kernel_nofault() > to check validity of pointers. When the pointer is NULL, > it points to userspace, leading to a KUAP fault and triggering > the following big hammer warning many times when you request > a sysrq "show task": > To avoid that, copy_from_kernel_nofault_allowed() is used to check > whether the address is a valid kernel address. But the default > version of it returns true for any address. > > Provide a powerpc version of copy_from_kernel_nofault_allowed() > that returns false when the address is below TASK_USER_MAX, > so that copy_from_kernel_nofault() will return -ERANGE. Looks good. I wonder if we should just default to the TASK_SIZE_MAX check in copy_from_kernel_nofault_allowed for architectures that select CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE? > > Reported-by: Qian Cai > Fixes: c33165253492 ("powerpc: use non-set_fs based maccess routines") > Cc: Christoph Hellwig > Cc: Al Viro > Signed-off-by: Christophe Leroy > --- > This issue was introduced in 5.10. I didn't mark it for stable, hopping it will go into 5.10-rc7 > --- > arch/powerpc/mm/Makefile | 2 +- > arch/powerpc/mm/maccess.c | 9 +++++++++ > 2 files changed, 10 insertions(+), 1 deletion(-) > create mode 100644 arch/powerpc/mm/maccess.c > > diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile > index 5e147986400d..55b4a8bd408a 100644 > --- a/arch/powerpc/mm/Makefile > +++ b/arch/powerpc/mm/Makefile > @@ -5,7 +5,7 @@ > > ccflags-$(CONFIG_PPC64) := $(NO_MINIMAL_TOC) > > -obj-y := fault.o mem.o pgtable.o mmap.o \ > +obj-y := fault.o mem.o pgtable.o mmap.o maccess.o \ > init_$(BITS).o pgtable_$(BITS).o \ > pgtable-frag.o ioremap.o ioremap_$(BITS).o \ > init-common.o mmu_context.o drmem.o > diff --git a/arch/powerpc/mm/maccess.c b/arch/powerpc/mm/maccess.c > new file mode 100644 > index 000000000000..56e97c0fb233 > --- /dev/null > +++ b/arch/powerpc/mm/maccess.c > @@ -0,0 +1,9 @@ > +// SPDX-License-Identifier: GPL-2.0-only > + > +#include > +#include > + > +bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size) > +{ > + return (unsigned long)unsafe_src >= TASK_SIZE_MAX; > +} > -- > 2.25.0 ---end quoted text---