From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751643AbdATIue (ORCPT <rfc822;w@1wt.eu>);
        Fri, 20 Jan 2017 03:50:34 -0500
Received: from Galois.linutronix.de ([146.0.238.70]:59730 "EHLO
        Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751476AbdATIuc (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 20 Jan 2017 03:50:32 -0500
Date: Fri, 20 Jan 2017 09:50:00 +0100 (CET)
From: Thomas Gleixner <tglx@linutronix.de>
To: Peter Zijlstra <peterz@infradead.org>
cc: Andy Lutomirski <luto@amacapital.net>, David Smith <dsmith@redhat.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Ingo Molnar <mingo@kernel.org>, "H. Peter Anvin" <hpa@zytor.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "Frank Ch. Eigler" <fche@redhat.com>
Subject: Re: [RFC][PATCH] x86: Verify access_ok() context
In-Reply-To: <20170120082406.GJ6515@twins.programming.kicks-ass.net>
Message-ID: <alpine.DEB.2.20.1701200936260.3602@nanos>
References: <20161122095715.GN3092@twins.programming.kicks-ass.net> <CALCETrW2mdAo59OW0+VfqTg8OAXe9qmiq23dex62a1ry0u2=Vw@mail.gmail.com> <20161122193720.GA3045@worktop.programming.kicks-ass.net> <CA+55aFzUq8uqsJyZRdNy4Rt11L561YcahwtTkHNU3Y2LeXGJEw@mail.gmail.com>
 <20161205102747.GT3092@twins.programming.kicks-ass.net> <f84a1055-f65b-fcd8-c914-46b328acd172@redhat.com> <alpine.DEB.2.20.1701162211570.3923@nanos> <8758e5b4-050d-a5dd-2e58-e4f9dccc734b@redhat.com> <CALCETrUTtg5GRmn-rKMUHfLSgDh8PPJn2MmKtmQTYOKV_jisQw@mail.gmail.com>
 <20170120082406.GJ6515@twins.programming.kicks-ass.net>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, 20 Jan 2017, Peter Zijlstra wrote:

> On Wed, Jan 18, 2017 at 04:19:47PM -0800, Andy Lutomirski wrote:
> > ISTM even with pagefault_disable() in play, using access_ok() from,
> > say, interrupt context is dangerous unless you've first checked that
> > you're in a task.  But I guess that in_task() would still return
> > false, e.g. in perf.
> 
> The test was created exactly because perf was using access_ok()
> _wrongly_. See commit: ae31fe51a3cc ("perf/x86: Restore TASK_SIZE check
> on frame pointer").

If you validate a user space address against current outside the task
context, then what guarantees that this user space address belongs to
current? Nothing!

Sure, there are interrupts like breakpoints, etc. where we exactly know
that the address which we are looking at belongs to current, because the
code accesses soemthing which belongs exactly to that breakpoint. And in
these cases we need a check which is designed specifically for that case.

Thanks,

	tglx