From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8BD34C433B4 for ; Tue, 18 May 2021 03:58:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6A20C6124C for ; Tue, 18 May 2021 03:58:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345337AbhERD70 (ORCPT ); Mon, 17 May 2021 23:59:26 -0400 Received: from out03.mta.xmission.com ([166.70.13.233]:36684 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242998AbhERD7A (ORCPT ); Mon, 17 May 2021 23:59:00 -0400 Received: from in02.mta.xmission.com ([166.70.13.52]) by out03.mta.xmission.com with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1liqrO-001BZ4-7u; Mon, 17 May 2021 21:57:34 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=fess.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from ) id 1liqrN-00Dqoh-3t; Mon, 17 May 2021 21:57:33 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Arnd Bergmann Cc: linux-arch@vger.kernel.org, Arnd Bergmann , Christoph Hellwig , Alexander Viro , Andrew Morton , Borislav Petkov , Brian Gerst , Ingo Molnar , "H. Peter Anvin" , Thomas Gleixner , Linux ARM , linux-kernel@vger.kernel.org, Linux-MM , kexec@lists.infradead.org References: <20210517203343.3941777-1-arnd@kernel.org> <20210517203343.3941777-2-arnd@kernel.org> Date: Mon, 17 May 2021 22:57:24 -0500 In-Reply-To: <20210517203343.3941777-2-arnd@kernel.org> (Arnd Bergmann's message of "Mon, 17 May 2021 22:33:40 +0200") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-SPF: eid=1liqrN-00Dqoh-3t;;;mid=;;;hst=in02.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1+4F4J6T7VILKXf+JC2PApdv1NzJS5heMQ= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com Subject: Re: [PATCH v3 1/4] kexec: simplify compat_sys_kexec_load X-SA-Exim-Version: 4.2.1 (built Sat, 08 Feb 2020 21:53:50 +0000) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Arnd Bergmann writes: > From: Arnd Bergmann > > The compat version of sys_kexec_load() uses compat_alloc_user_space to > convert the user-provided arguments into the native format. > > Move the conversion into the regular implementation with > an in_compat_syscall() check to simplify it and avoid the > compat_alloc_user_space() call. > > compat_sys_kexec_load() now behaves the same as sys_kexec_load(). Is it possible to do this without in_compat_syscall(), and casting pointers to a wrong type? We open ourselves up to bugs whenever we lie to the type system. Skimming through the code it looks like it should be possible to not need the in_compat_syscall and the casts to the wrong type by changing the order of the code a little bit. Eric > Signed-off-by: Arnd Bergmann > --- > include/linux/kexec.h | 2 - > kernel/kexec.c | 95 +++++++++++++++++++------------------------ > 2 files changed, 42 insertions(+), 55 deletions(-) > > diff --git a/include/linux/kexec.h b/include/linux/kexec.h > index 0c994ae37729..f61e310d7a85 100644 > --- a/include/linux/kexec.h > +++ b/include/linux/kexec.h > @@ -88,14 +88,12 @@ struct kexec_segment { > size_t memsz; > }; > > -#ifdef CONFIG_COMPAT > struct compat_kexec_segment { > compat_uptr_t buf; > compat_size_t bufsz; > compat_ulong_t mem; /* User space sees this as a (void *) ... */ > compat_size_t memsz; > }; > -#endif > > #ifdef CONFIG_KEXEC_FILE > struct purgatory_info { > diff --git a/kernel/kexec.c b/kernel/kexec.c > index c82c6c06f051..6618b1d9f00b 100644 > --- a/kernel/kexec.c > +++ b/kernel/kexec.c > @@ -19,21 +19,46 @@ > > #include "kexec_internal.h" > > +static int copy_user_compat_segment_list(struct kimage *image, > + unsigned long nr_segments, > + void __user *segments) > +{ > + struct compat_kexec_segment __user *cs = segments; > + struct compat_kexec_segment segment; > + int i; > + > + for (i = 0; i < nr_segments; i++) { > + if (copy_from_user(&segment, &cs[i], sizeof(segment))) > + return -EFAULT; > + > + image->segment[i] = (struct kexec_segment) { > + .buf = compat_ptr(segment.buf), > + .bufsz = segment.bufsz, > + .mem = segment.mem, > + .memsz = segment.memsz, > + }; > + } > + > + return 0; > +} > + > + > static int copy_user_segment_list(struct kimage *image, > unsigned long nr_segments, > struct kexec_segment __user *segments) > { > - int ret; > size_t segment_bytes; > > /* Read in the segments */ > image->nr_segments = nr_segments; > segment_bytes = nr_segments * sizeof(*segments); > - ret = copy_from_user(image->segment, segments, segment_bytes); > - if (ret) > - ret = -EFAULT; > + if (in_compat_syscall()) > + return copy_user_compat_segment_list(image, nr_segments, segments); > > - return ret; > + if (copy_from_user(image->segment, segments, segment_bytes)) > + return -EFAULT; > + > + return 0; > } > > static int kimage_alloc_init(struct kimage **rimage, unsigned long entry, > @@ -233,8 +258,9 @@ static inline int kexec_load_check(unsigned long nr_segments, > return 0; > } > > -SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, > - struct kexec_segment __user *, segments, unsigned long, flags) > +static int kernel_kexec_load(unsigned long entry, unsigned long nr_segments, > + struct kexec_segment __user * segments, > + unsigned long flags) > { > int result; > > @@ -265,57 +291,20 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, > return result; > } > > +SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, > + struct kexec_segment __user *, segments, unsigned long, flags) > +{ > + return kernel_kexec_load(entry, nr_segments, segments, flags); > +} > + > #ifdef CONFIG_COMPAT > COMPAT_SYSCALL_DEFINE4(kexec_load, compat_ulong_t, entry, > compat_ulong_t, nr_segments, > struct compat_kexec_segment __user *, segments, > compat_ulong_t, flags) > { > - struct compat_kexec_segment in; > - struct kexec_segment out, __user *ksegments; > - unsigned long i, result; > - > - result = kexec_load_check(nr_segments, flags); > - if (result) > - return result; > - > - /* Don't allow clients that don't understand the native > - * architecture to do anything. > - */ > - if ((flags & KEXEC_ARCH_MASK) == KEXEC_ARCH_DEFAULT) > - return -EINVAL; > - > - ksegments = compat_alloc_user_space(nr_segments * sizeof(out)); > - for (i = 0; i < nr_segments; i++) { > - result = copy_from_user(&in, &segments[i], sizeof(in)); > - if (result) > - return -EFAULT; > - > - out.buf = compat_ptr(in.buf); > - out.bufsz = in.bufsz; > - out.mem = in.mem; > - out.memsz = in.memsz; > - > - result = copy_to_user(&ksegments[i], &out, sizeof(out)); > - if (result) > - return -EFAULT; > - } > - > - /* Because we write directly to the reserved memory > - * region when loading crash kernels we need a mutex here to > - * prevent multiple crash kernels from attempting to load > - * simultaneously, and to prevent a crash kernel from loading > - * over the top of a in use crash kernel. > - * > - * KISS: always take the mutex. > - */ > - if (!mutex_trylock(&kexec_mutex)) > - return -EBUSY; > - > - result = do_kexec_load(entry, nr_segments, ksegments, flags); > - > - mutex_unlock(&kexec_mutex); > - > - return result; > + return kernel_kexec_load(entry, nr_segments, > + (struct kexec_segment __user *)segments, > + flags); > } > #endif