From: Al Viro <viro@zeniv.linux.org.uk>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Arnd Bergmann <arnd@kernel.org>,
Christoph Hellwig <hch@infradead.org>,
Christoph Hellwig <hch@lst.de>,
linux-arch <linux-arch@vger.kernel.org>,
Linux-MM <linux-mm@kvack.org>,
Linux API <linux-api@vger.kernel.org>,
Arnd Bergmann <arnd@arndb.de>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Rich Felker <dalias@libc.org>,
linux-ia64@vger.kernel.org,
Linux-sh list <linux-sh@vger.kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Max Filippov <jcmvbkbc@gmail.com>, Guo Ren <guoren@kernel.org>,
sparclinux <sparclinux@vger.kernel.org>,
"open list:QUALCOMM HEXAGON..." <linux-hexagon@vger.kernel.org>,
linux-riscv <linux-riscv@lists.infradead.org>,
Will Deacon <will@kernel.org>, Ard Biesheuvel <ardb@kernel.org>,
linux-s390 <linux-s390@vger.kernel.org>,
Brian Cain <bcain@codeaurora.org>, Helge Deller <deller@gmx.de>,
the arch/x86 maintainers <x86@kernel.org>,
Russell King - ARM Linux <linux@armlinux.org.uk>,
linux-csky@vger.kernel.org, Ingo Molnar <mingo@redhat.com>,
Geert Uytterhoeven <geert@linux-m68k.org>,
"open list:SYNOPSYS ARC ARCHITECTURE"
<linux-snps-arc@lists.infradead.org>,
"open list:TENSILICA XTENSA PORT (xtensa)"
<linux-xtensa@linux-xtensa.org>,
Heiko Carstens <hca@linux.ibm.com>,
alpha <linux-alpha@vger.kernel.org>,
linux-um <linux-um@lists.infradead.org>,
linux-m68k <linux-m68k@lists.linux-m68k.org>,
Openrisc <openrisc@lists.librecores.org>,
Greentime Hu <green.hu@gmail.com>,
Stafford Horne <shorne@gmail.com>,
Linux ARM <linux-arm-kernel@lists.infradead.org>,
Michal Simek <monstr@monstr.eu>,
Thomas Bogendoerfer <tsbogend@alpha.franken.de>,
Parisc List <linux-parisc@vger.kernel.org>,
Nick Hu <nickhu@andestech.com>,
"open list:BROADCOM NVRAM DRIVER" <linux-mips@vger.kernel.org>,
Dinh Nguyen <dinguyen@kernel.org>,
"Eric W . Biederman" <ebiederm@xmission.com>,
Richard Weinberger <richard@nod.at>,
Andrew Morton <akpm@linux-foundation.org>,
linuxppc-dev <linuxppc-dev@lists.ozlabs.org>,
David Miller <davem@davemloft.net>
Subject: Re: [PATCH 04/14] x86: use more conventional access_ok() definition
Date: Tue, 15 Feb 2022 02:47:05 +0000 [thread overview]
Message-ID: <YgsUKcXGR7r4nINj@zeniv-ca.linux.org.uk> (raw)
In-Reply-To: <Ygq4wy9fikDYmuHU@zeniv-ca.linux.org.uk>
On Mon, Feb 14, 2022 at 08:17:07PM +0000, Al Viro wrote:
> On Mon, Feb 14, 2022 at 12:01:05PM -0800, Linus Torvalds wrote:
> > On Mon, Feb 14, 2022 at 11:46 AM Arnd Bergmann <arnd@kernel.org> wrote:
> > >
> > > As Al pointed out, they turned out to be necessary on sparc64, but the only
> > > definitions are on sparc64 and x86, so it's possible that they serve a similar
> > > purpose here, in which case changing the limit from TASK_SIZE to
> > > TASK_SIZE_MAX is probably wrong as well.
> >
> > x86-64 has always(*) used TASK_SIZE_MAX for access_ok(), and the
> > get_user() assembler implementation does the same.
> >
> > I think any __range_not_ok() users that use TASK_SIZE are entirely
> > historical, and should be just fixed.
>
> IIRC, that was mostly userland stack trace collection in perf.
> I'll try to dig in archives and see what shows up - it's been
> a while ago...
After some digging:
access_ok() needs only to make sure that MMU won't go anywhere near
the kernel page tables; address limit for 32bit threads is none of its
concern, so TASK_SIZE_MAX is right for it.
valid_user_frame() in arch/x86/events/core.c: used while walking
the userland call chain. The reason it's not access_ok() is only that
perf_callchain_user() might've been called from interrupt that came while
we'd been under KERNEL_DS.
That had been back in 2015 and it had been obsoleted since 2017, commit
88b0193d9418 (perf/callchain: Force USER_DS when invoking perf_callchain_user()).
We had been guaranteed USER_DS ever since.
IOW, it could've reverted to use of access_ok() at any point after that.
TASK_SIZE vs TASK_SIZE_MAX is pretty much an accident there - might've been
TASK_SIZE_MAX from the very beginning.
copy_stack_frame() in arch/x86/kernel/stacktrace.c: similar story,
except the commit that made sure callers will have USER_DS - cac9b9a4b083
(stacktrace: Force USER_DS for stack_trace_save_user()) in this case.
Also could've been using access_ok() just fine. Amusingly, access_ok()
used to be there, until it had been replaced with explicit check on
Jul 22 2019 - 4 days after that had been made useless by fix in the caller...
copy_from_user_nmi(). That one is a bit more interesting.
We have a call chain from perf_output_sample_ustack() (covered by
force_uaccess_begin() these days, not that it mattered for x86 now),
there's something odd in dumpstack.c:copy_code() (with explicit check
for TASK_SIZE_MAX in the caller) and there's a couple of callers in
Intel PMU code.
AFAICS, there's no reason whatsoever to use TASK_SIZE
in that one - the point is to prevent copyin from the kernel
memory, and in that respect TASK_SIZE_MAX isn't any worse.
The check in copy_code() probably should go.
So all of those guys should be simply switched to access_ok().
Might be worth making that a preliminary patch - it's independent
from everything else and there's no point folding it into any of the
patches in the series.
next prev parent reply other threads:[~2022-02-15 2:47 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-14 16:34 [PATCH 00/14] clean up asm/uaccess.h, kill set_fs for good Arnd Bergmann
2022-02-14 16:34 ` [PATCH 01/14] uaccess: fix integer overflow on access_ok() Arnd Bergmann
2022-02-14 16:58 ` Christoph Hellwig
2022-02-14 16:34 ` [PATCH 02/14] sparc64: add __{get,put}_kernel_nocheck() Arnd Bergmann
2022-02-14 16:34 ` [PATCH 03/14] nds32: fix access_ok() checks in get/put_user Arnd Bergmann
2022-02-14 17:01 ` Christoph Hellwig
2022-02-14 17:10 ` David Laight
2022-02-15 9:18 ` Arnd Bergmann
2022-02-15 10:25 ` Greg KH
2022-02-14 16:34 ` [PATCH 04/14] x86: use more conventional access_ok() definition Arnd Bergmann
2022-02-14 17:02 ` Christoph Hellwig
2022-02-14 19:45 ` Arnd Bergmann
2022-02-14 20:00 ` Christoph Hellwig
2022-02-14 20:01 ` Linus Torvalds
2022-02-14 20:17 ` Al Viro
2022-02-15 2:47 ` Al Viro [this message]
2022-02-14 20:24 ` Linus Torvalds
2022-02-14 22:13 ` David Laight
2022-02-14 16:34 ` [PATCH 05/14] uaccess: add generic __{get,put}_kernel_nofault Arnd Bergmann
2022-02-14 17:02 ` Christoph Hellwig
2022-02-15 0:31 ` Al Viro
2022-02-15 13:16 ` Arnd Bergmann
2022-02-14 16:34 ` [PATCH 06/14] mips: use simpler access_ok() Arnd Bergmann
2022-02-14 16:34 ` [PATCH 07/14] uaccess: generalize access_ok() Arnd Bergmann
2022-02-14 17:04 ` Christoph Hellwig
2022-02-14 17:15 ` Al Viro
2022-02-14 19:25 ` Arnd Bergmann
2022-02-15 10:58 ` Mark Rutland
2022-02-14 16:34 ` [PATCH 08/14] arm64: simplify access_ok() Arnd Bergmann
2022-02-14 21:06 ` Robin Murphy
2022-02-15 8:17 ` Ard Biesheuvel
2022-02-15 9:12 ` Arnd Bergmann
2022-02-15 9:21 ` Ard Biesheuvel
2022-02-15 9:39 ` Arnd Bergmann
2022-02-15 10:39 ` Mark Rutland
2022-02-15 10:37 ` Mark Rutland
2022-02-16 19:43 ` Christophe Leroy
2022-02-15 9:30 ` David Laight
2022-02-15 11:24 ` Mark Rutland
2022-02-15 11:07 ` Mark Rutland
2022-02-14 16:34 ` [PATCH 09/14] m68k: drop custom __access_ok() Arnd Bergmann
2022-02-15 0:37 ` Al Viro
2022-02-15 6:29 ` Christoph Hellwig
2022-02-15 7:13 ` Al Viro
2022-02-15 10:02 ` Arnd Bergmann
2022-02-15 13:28 ` David Laight
2022-02-14 16:34 ` [PATCH 10/14] uaccess: remove most CONFIG_SET_FS users Arnd Bergmann
2022-02-14 17:06 ` Christoph Hellwig
2022-02-14 19:40 ` Arnd Bergmann
2022-02-14 16:34 ` [PATCH 11/14] sparc64: remove CONFIG_SET_FS support Arnd Bergmann
2022-02-14 17:06 ` Christoph Hellwig
2022-02-16 13:06 ` Arnd Bergmann
2022-02-15 0:48 ` Al Viro
2022-02-16 13:07 ` Arnd Bergmann
2022-02-14 16:34 ` [PATCH 12/14] sh: " Arnd Bergmann
2022-02-14 16:34 ` [PATCH 13/14] ia64: " Arnd Bergmann
2022-02-14 16:34 ` [PATCH 14/14] uaccess: drop set_fs leftovers Arnd Bergmann
2022-02-15 3:03 ` Al Viro
2022-02-15 7:46 ` Helge Deller
2022-02-15 8:10 ` Arnd Bergmann
2022-02-14 17:35 ` [PATCH 00/14] clean up asm/uaccess.h, kill set_fs for good Linus Torvalds
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YgsUKcXGR7r4nINj@zeniv-ca.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=akpm@linux-foundation.org \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=arnd@kernel.org \
--cc=bcain@codeaurora.org \
--cc=dalias@libc.org \
--cc=davem@davemloft.net \
--cc=deller@gmx.de \
--cc=dinguyen@kernel.org \
--cc=ebiederm@xmission.com \
--cc=geert@linux-m68k.org \
--cc=green.hu@gmail.com \
--cc=guoren@kernel.org \
--cc=hca@linux.ibm.com \
--cc=hch@infradead.org \
--cc=hch@lst.de \
--cc=jcmvbkbc@gmail.com \
--cc=linux-alpha@vger.kernel.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-csky@vger.kernel.org \
--cc=linux-hexagon@vger.kernel.org \
--cc=linux-ia64@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-m68k@lists.linux-m68k.org \
--cc=linux-mips@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-parisc@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux-sh@vger.kernel.org \
--cc=linux-snps-arc@lists.infradead.org \
--cc=linux-um@lists.infradead.org \
--cc=linux-xtensa@linux-xtensa.org \
--cc=linux@armlinux.org.uk \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mark.rutland@arm.com \
--cc=mingo@redhat.com \
--cc=monstr@monstr.eu \
--cc=nickhu@andestech.com \
--cc=openrisc@lists.librecores.org \
--cc=peterz@infradead.org \
--cc=richard@nod.at \
--cc=shorne@gmail.com \
--cc=sparclinux@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tsbogend@alpha.franken.de \
--cc=will@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).