Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1487617

Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok()

Show all headers | View raw

On Tue, Sep 20, 2016 at 12:07 PM, Al Viro <viro@zeniv.linux.org.uk> wrote:
> Switching iov_iter fault-in to multipages variants has exposed an old
> bug in underlying fault_in_multipages_...(); they break if the range
> passed to them wraps around.  Normally access_ok() done by callers
> will prevent such (and it's a guaranteed EFAULT - ERR_PTR() values
> fall into such a range and they should not point to any valid objects).
> However, on architectures where userland and kernel live in different
> MMU contexts (e.g. s390) access_ok() is a no-op and on those a range
> with a wraparound can reach fault_in_multipages_...().

Quite frankly, I think it is access_ok() that should be fixed for s390.

A wrapping user access is *not* ok, not even if kernel and user memory
are separate.

It is insane to make fault_in_multipages..() return EFAULT if a normal
wrapping user access wouldn't. So the fix is not to change
fault_in_multipage_xyz, but to make sure any op that tries to wrap
will properly return EFAULT.

So I really think that we should just say "a no-op access_ok() is a
buggy access_ok()", and fix the problem at the source, rather than
make excuses for it in some random place.

A quick look seems to say that s390 and no-mmu ARM are the only
affected cases, but maybe I missed something.

              Linus

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[bug] pwritev02 hang on s390x with 4.8.0-rc7 Jan Stancek <jstancek@redhat.com> - 2016-09-20 15:00 +0200
  Re: [bug] pwritev02 hang on s390x with 4.8.0-rc7 Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 17:10 +0200
    Re: [bug] pwritev02 hang on s390x with 4.8.0-rc7 Jan Stancek <jstancek@redhat.com> - 2016-09-20 19:20 +0200
      Re: [bug] pwritev02 hang on s390x with 4.8.0-rc7 Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 19:40 +0200
      [PATCH] fix fault_in_multipages_...() on architectures with no-op  access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 21:10 +0200
        Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok() Linus Torvalds <torvalds@linux-foundation.org> - 2016-09-20 22:30 +0200
          Re: [PATCH] fix fault_in_multipages_...() on architectures with  no-op access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 22:40 +0200
            Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok() Linus Torvalds <torvalds@linux-foundation.org> - 2016-09-20 22:50 +0200
              Re: [PATCH] fix fault_in_multipages_...() on architectures with  no-op access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 23:10 +0200
                Re: [PATCH] fix fault_in_multipages_...() on architectures with  no-op access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 23:40 +0200
                Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok() Linus Torvalds <torvalds@linux-foundation.org> - 2016-09-21 01:50 +0200
                Re: [PATCH] fix fault_in_multipages_...() on architectures with  no-op access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-21 02:40 +0200

csiph-web