From: Linus Torvalds <torvalds@linux-foundation.org>
To: Al Viro <viro@zeniv.linux.org.uk>,
Christophe Leroy <christophe.leroy@c-s.fr>,
Michael Ellerman <mpe@ellerman.id.au>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
"the arch/x86 maintainers" <x86@kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: objtool clac/stac handling change..
Date: Wed, 1 Jul 2020 13:25:36 -0700 [thread overview]
Message-ID: <CAHk-=wj-CYhKZR8ZKQgi=VTx=o7n6dtwPXikvgkJ3SdiqRPd8A@mail.gmail.com> (raw)
In-Reply-To: <20200701195914.GK2786714@ZenIV.linux.org.uk>
On Wed, Jul 1, 2020 at 12:59 PM Al Viro <viro@zeniv.linux.org.uk> wrote:
>
> On Wed, Jul 01, 2020 at 12:04:36PM -0700, Linus Torvalds wrote:
> >
> > That's actually for the access granting. Shutting the access down ends
> > up always doing the same thing anyway..
>
> #define user_read_access_end prevent_current_read_from_user
> #define user_write_access_end prevent_current_write_to_user
> static inline void prevent_current_read_from_user(void)
> {
> prevent_user_access(NULL, NULL, ~0UL, KUAP_CURRENT_READ);
> }
>
> static inline void prevent_current_write_to_user(void)
> {
> prevent_user_access(NULL, NULL, ~0UL, KUAP_CURRENT_WRITE);
> }
>
> and prevent_user_access() has instances that do care about the direction...
Go and look closer.
There are three cases:
(a) the 32-bit book3s case. It looks like it cares, but when you look
closer, it ends up not caring about the read side, and saving the
"which address to I allow user writes to" in current->thread.kuap
(b) the nohash 32-bit case - doesn't care
(c) the 64-bit books case - doesn't care
So yes, in the (a) case it does make a difference between reads and
writes, but at least as far as I can tell, it ignores the read case,
and has code to avoid the unnecessary "disable user writes" case when
there was only a read enable done.
Now, it's possible that I'm wrong, but the upshot of that is that even
on powerpc, I think that if we just made the rule be that "taking a
user exception should automatically do the 'user_access_end()' for us"
is trivial.
But I'll add the powerpc people to the list too. And the arm64 people
too, although it looks like they still haven't actually made the
uaccess_disable() logic visible as user_access_begin/end and the
unsafe_xyz code, so they'd not be impacted.
Christophe/Michael: the discussion is that I'd actually want to change
the "exception on user access" case to do the user_access_end()
automatically, so that you can write code like
if (!user_access_begin(...))
goto out;
unsafe_get_user(..., out);
unsafe_get_user(..., out);
user_access_end();
.. all is good, use the value we got..
return 0;
out:
return -EFAULT;
and use the same error label for both the "user_access_begin() failed"
_and_ for the "oops, the access faulted".
Right now the code needs to explicitly do the user_access_end()
handling manually if one of the accesses fault.
See for example fs/readdir.c, which has that
efault_end:
user_write_access_end();
efault:
buf->result = -EFAULT;
return -EFAULT;
pattern of two different error targets several times. I'd like to
avoid that user_{read_,write_,}access_end() case for the error
handling entirely. It's extra complexity.
I checked every single non-arch user, and for all of them it was just
extra work (eg i915 driver, readdir, select, etc)
The only case it wasn't an extra bother was the
lib/strn{cpy,len}_from_user() cases, but that was because I literally
organized the code to call a helper function be called in such a way
that it always did the right thing.
Linus
next prev parent reply other threads:[~2020-07-01 20:25 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-01 18:22 objtool clac/stac handling change Linus Torvalds
2020-07-01 18:29 ` Andy Lutomirski
2020-07-01 19:35 ` Linus Torvalds
2020-07-01 20:36 ` Andy Lutomirski
2020-07-01 20:51 ` Josh Poimboeuf
2020-07-01 21:02 ` Linus Torvalds
2020-07-02 0:00 ` Josh Poimboeuf
2020-07-02 8:05 ` Peter Zijlstra
2020-07-01 20:51 ` Linus Torvalds
2020-07-02 0:47 ` Andy Lutomirski
2020-07-02 2:30 ` Linus Torvalds
2020-07-02 2:35 ` Linus Torvalds
2020-07-02 3:08 ` Andy Lutomirski
2020-07-01 18:41 ` Al Viro
2020-07-01 19:04 ` Linus Torvalds
2020-07-01 19:59 ` Al Viro
2020-07-01 20:25 ` Linus Torvalds [this message]
2020-07-02 13:34 ` Michael Ellerman
2020-07-02 14:01 ` Al Viro
2020-07-02 14:04 ` Al Viro
2020-07-02 15:13 ` Christophe Leroy
2020-07-02 20:13 ` Linus Torvalds
2020-07-03 3:59 ` Michael Ellerman
2020-07-03 3:17 ` Michael Ellerman
2020-07-03 5:27 ` Christophe Leroy
2020-07-02 19:52 ` Linus Torvalds
2020-07-02 20:17 ` Al Viro
2020-07-02 20:32 ` Linus Torvalds
2020-07-02 20:59 ` Al Viro
2020-07-02 21:55 ` Linus Torvalds
2020-07-03 1:33 ` Al Viro
2020-07-03 3:32 ` Linus Torvalds
2020-07-03 21:02 ` Al Viro
2020-07-03 21:10 ` Linus Torvalds
2020-07-03 21:41 ` Andy Lutomirski
2020-07-03 22:25 ` Al Viro
2020-07-03 21:59 ` Al Viro
2020-07-03 22:04 ` Al Viro
2020-07-03 22:12 ` Al Viro
2020-07-04 0:49 ` Al Viro
2020-07-04 1:54 ` Linus Torvalds
2020-07-04 2:30 ` Al Viro
2020-07-04 3:06 ` Linus Torvalds
2020-07-04 2:11 ` Al Viro
2020-07-07 12:35 ` David Laight
2020-07-10 22:37 ` Linus Torvalds
2020-07-13 9:32 ` David Laight
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHk-=wj-CYhKZR8ZKQgi=VTx=o7n6dtwPXikvgkJ3SdiqRPd8A@mail.gmail.com' \
--to=torvalds@linux-foundation.org \
--cc=christophe.leroy@c-s.fr \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mpe@ellerman.id.au \
--cc=peterz@infradead.org \
--cc=viro@zeniv.linux.org.uk \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).