From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6065EC43334 for ; Mon, 13 Jun 2022 17:04:59 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id ED0C88D01AB; Mon, 13 Jun 2022 13:04:58 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E7EE98D01A1; Mon, 13 Jun 2022 13:04:58 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D1F948D01AB; Mon, 13 Jun 2022 13:04:58 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id C0DAA8D01A1 for ; Mon, 13 Jun 2022 13:04:58 -0400 (EDT) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 9C52DA33 for ; Mon, 13 Jun 2022 17:04:58 +0000 (UTC) X-FDA: 79573837476.02.D6E20F0 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) by imf14.hostedemail.com (Postfix) with ESMTP id 1777B10007F for ; Mon, 13 Jun 2022 17:04:57 +0000 (UTC) Received: by mail-pl1-f182.google.com with SMTP id o17so5598180pla.6 for ; Mon, 13 Jun 2022 10:04:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=in7tslnl1pN8vUFguET+89DVtHxfd8oga9pQJTnUjCA=; b=jlfG4XX0JZah9ScTkDAu897hir02bkHLVC2OYUVBinaVFpgcy1iM5ms5NVWoXZ4wIP upQwf52fotHK+u4MTDiQ5gLqeinihIHDyD8Z0Pi+9a1LeBglZoSmERkxWfOrXxaaOQf4 /nrqOnyuIDqGI40xhulBwgyn2MDsJ9hzrB71M= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=in7tslnl1pN8vUFguET+89DVtHxfd8oga9pQJTnUjCA=; b=Mc/Lv8sF8c52uNzDqIXLAmE180GgLAS8JYsnaqsAynauQS7wLy/Skv615d4MMYFRza m70vaBInlShFvgE6qpP0j3rxEr9lIZnHMkWsehSgnkU0i/IdTFlgHJZBDkWlO+lB4o0B mkg2ofs1b86t2HUV5zM6IzCC2e0FWguYZNaQ12knmXsCI99GA8m3l4bvKhdYj3JbLG7l hDjeZ4+l8sG8dgFpCEc9fuXTC14idbGP1rsTw7oxTpdTAF7PA1RNHJzphU2SJ9MfCBrC V9PBOTio3EUZLtG4HKyMlqKYHiCOsSZCQ/U21KrwoBkg45LcNqMvtdjV3FsfzO5qkH5S yNLw== X-Gm-Message-State: AJIora8BTg2YB9Y06QQOdFvjhSjgVdxwbg4CT7MLWr6cnKD6XvlneQ1G ZRJnEQ/jQeplspcHak1B+aam1w== X-Google-Smtp-Source: AGRyM1ukNi6ZKghruMyMgq9ihVMgVUUHQPC5Ae0JokRXjO5moqGBTsopK5QZ+vZZb16JEEdiAMBHng== X-Received: by 2002:a17:903:1211:b0:168:e42f:86ff with SMTP id l17-20020a170903121100b00168e42f86ffmr107663plh.112.1655139896906; Mon, 13 Jun 2022 10:04:56 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id j64-20020a62c543000000b0050dc762819bsm5670671pfg.117.2022.06.13.10.04.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jun 2022 10:04:56 -0700 (PDT) Date: Mon, 13 Jun 2022 10:04:55 -0700 From: Kees Cook To: Uladzislau Rezki Cc: Matthew Wilcox , linux-mm@kvack.org, Zorro Lang , linux-xfs@vger.kernel.org, linux-hardening@vger.kernel.org Subject: Re: [PATCH 1/3] usercopy: Handle vm_map_ram() areas Message-ID: <202206131004.CF19D5659@keescook> References: <20220612213227.3881769-1-willy@infradead.org> <20220612213227.3881769-2-willy@infradead.org> <202206130922.A218C4E3E8@keescook> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1655139898; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=in7tslnl1pN8vUFguET+89DVtHxfd8oga9pQJTnUjCA=; b=bc9LyBHMeO8g4/ZpntH31UCwUOBcZubAPRISreU8e8+fpcoEYgB+mepaQF3SdS2dMdJYhG ykQpu/D2KESNBgQziwteWE6Kqr/UbJCwDaXNuslWmYzkEewrF5vGiww5fDoe6+G5jDbsrl vDhjEOiTrjmbnjSg+zhceBYK40LR6Ag= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=jlfG4XX0; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf14.hostedemail.com: domain of keescook@chromium.org designates 209.85.214.182 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1655139898; a=rsa-sha256; cv=none; b=5A+YuKpv9dWNKUaZNC/21aHcma1t02mP3DpUDUgiZmP/LtZ6knPtYSiPVDjvZ1ZCfCnlg7 o7DnDUHVy/UQC3dsU1k/tbd86shKrhE7jTHMSWNRTMTJfXXlrBJN8I/0vXQGWjwYchEpf0 jnQGtOvrTaqGb6SodH4VluioMtD0090= X-Stat-Signature: nrkybxpt5ja9djf66y3b46qfcjbtzkmb X-Rspamd-Queue-Id: 1777B10007F X-Rspam-User: X-Rspamd-Server: rspam05 Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=jlfG4XX0; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf14.hostedemail.com: domain of keescook@chromium.org designates 209.85.214.182 as permitted sender) smtp.mailfrom=keescook@chromium.org X-HE-Tag: 1655139897-765583 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Jun 13, 2022 at 07:02:10PM +0200, Uladzislau Rezki wrote: > On Mon, Jun 13, 2022 at 05:44:35PM +0100, Matthew Wilcox wrote: > > On Mon, Jun 13, 2022 at 09:23:15AM -0700, Kees Cook wrote: > > > On Sun, Jun 12, 2022 at 10:32:25PM +0100, Matthew Wilcox (Oracle) wrote: > > > > vmalloc does not allocate a vm_struct for vm_map_ram() areas. That causes > > > > us to deny usercopies from those areas. This affects XFS which uses > > > > vm_map_ram() for its directories. > > > > > > > > Fix this by calling find_vmap_area() instead of find_vm_area(). > > > > > > Thanks for the fixes! > > > > > > > [...] > > > > + /* XXX: We should also abort for free vmap_areas */ > > > > > > What's needed to detect this? > > > > I'm not entirely sure. I only just learned of the existence of this > > struct ;-) > > > > /* > > * The following two variables can be packed, because > > * a vmap_area object can be either: > > * 1) in "free" tree (root is free_vmap_area_root) > > * 2) or "busy" tree (root is vmap_area_root) > > */ > > union { > > unsigned long subtree_max_size; /* in "free" tree */ > > struct vm_struct *vm; /* in "busy" tree */ > > }; > > > > Hmm. Actually, we only search vmap_area_root, so I suppose it can't > > be a free area. So this XXX can be removed, as we'll get NULL back > > if we've got a pointer to a free area. Ulad, do I have this right? > > > Yep, we find here only allocated areas which bind to the "vmap_area_root" > tree, so it can not be a freed area. So we will not get a pointer to the > free area :) Thanks! I've tweaked the patch to drop the XXX comment. -- Kees Cook