Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok()

From	Al Viro <viro@ZenIV.linux.org.uk>
Newsgroups	linux.kernel
Subject	Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok()
Date	2016-09-20 22:40 +0200
Message-ID	<sjzZD-7Uq-13@gated-at.bofh.it> (permalink)
References	<sjsOu-34H-23@gated-at.bofh.it> <sjuQh-4Gm-1@gated-at.bofh.it> <sjwS5-5V7-11@gated-at.bofh.it> <sjyAx-74A-11@gated-at.bofh.it> <sjzPY-7R6-15@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Sep 20, 2016 at 01:24:25PM -0700, Linus Torvalds wrote:

> Quite frankly, I think it is access_ok() that should be fixed for s390.
> 
> A wrapping user access is *not* ok, not even if kernel and user memory
> are separate.
> 
> It is insane to make fault_in_multipages..() return EFAULT if a normal
> wrapping user access wouldn't. So the fix is not to change
> fault_in_multipage_xyz, but to make sure any op that tries to wrap
> will properly return EFAULT.

Not the point.  Of course it *would* fail; the problem is that the loop
that would ping each page is never executed.  What happens is
	while (uaddr <= end) 
		touch uaddr
		uaddr += PAGE_SIZE
	if uaddr and end point to different pages
		ping end

What happens if uaddr is greater than end, thanks to wraparound?  Right,
we skip the loop entirely and all we do is one ping of the end.  Which
might very well succeed, leaving us with false positive.

Thread

[bug] pwritev02 hang on s390x with 4.8.0-rc7 Jan Stancek <jstancek@redhat.com> - 2016-09-20 15:00 +0200
  Re: [bug] pwritev02 hang on s390x with 4.8.0-rc7 Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 17:10 +0200
    Re: [bug] pwritev02 hang on s390x with 4.8.0-rc7 Jan Stancek <jstancek@redhat.com> - 2016-09-20 19:20 +0200
      Re: [bug] pwritev02 hang on s390x with 4.8.0-rc7 Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 19:40 +0200
      [PATCH] fix fault_in_multipages_...() on architectures with no-op  access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 21:10 +0200
        Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok() Linus Torvalds <torvalds@linux-foundation.org> - 2016-09-20 22:30 +0200
          Re: [PATCH] fix fault_in_multipages_...() on architectures with  no-op access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 22:40 +0200
            Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok() Linus Torvalds <torvalds@linux-foundation.org> - 2016-09-20 22:50 +0200
              Re: [PATCH] fix fault_in_multipages_...() on architectures with  no-op access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 23:10 +0200
                Re: [PATCH] fix fault_in_multipages_...() on architectures with  no-op access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-20 23:40 +0200
                Re: [PATCH] fix fault_in_multipages_...() on architectures with no-op access_ok() Linus Torvalds <torvalds@linux-foundation.org> - 2016-09-21 01:50 +0200
                Re: [PATCH] fix fault_in_multipages_...() on architectures with  no-op access_ok() Al Viro <viro@ZenIV.linux.org.uk> - 2016-09-21 02:40 +0200

csiph-web