From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linus Torvalds Subject: Re: [PULL] vhost: cleanups and fixes Date: Fri, 2 Nov 2018 10:10:45 -0700 Message-ID: References: <20181101171938-mutt-send-email-mst@kernel.org> <20181102114635.hi3q53kzmz4qljsf@lakrids.cambridge.arm.com> <20181102083018-mutt-send-email-mst@kernel.org> <20181102122937-mutt-send-email-mst@kernel.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: mark.rutland@arm.com, lenaic@lhuard.fr, mhocko@suse.com, Kees Cook , kvm@vger.kernel.org, netdev@vger.kernel.org, liang.z.li@intel.com, Linux Kernel Mailing List , virtualization@lists.linux-foundation.org, stefanha@redhat.com, joe@perches.com, Andrew Morton , mhocko@kernel.org, bijan.mottahedeh@oracle.com To: mst@redhat.com Return-path: In-Reply-To: <20181102122937-mutt-send-email-mst@kernel.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: virtualization-bounces@lists.linux-foundation.org Errors-To: virtualization-bounces@lists.linux-foundation.org List-Id: netdev.vger.kernel.org On Fri, Nov 2, 2018 at 9:59 AM Michael S. Tsirkin wrote: > > Just for completeness I'd like to point out for vhost the copies are > done from the kernel thread. So yes we can switch to copy_to/from_user > but for e.g. 32-bit userspace running on top of a 64 bit kernel it is > IIUC not sufficient - we must *also* do access_ok checks on control path > when addresses are passed to the kernel and when current points to the > correct task struct. Don't you take over the VM with "use_mm()" when you do the copies? So yes, it's a kernel thread, but it has a user VM, and though that should have the user limits. No? Linus