From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C530C77B7C for ; Sun, 22 Jun 2025 23:45:43 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B8AD36B009D; Sun, 22 Jun 2025 19:45:42 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B627A6B00AC; Sun, 22 Jun 2025 19:45:42 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A9F606B00AD; Sun, 22 Jun 2025 19:45:42 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 9632E6B00AC for ; Sun, 22 Jun 2025 19:45:42 -0400 (EDT) Received: from smtpin25.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 3566B141051 for ; Sun, 22 Jun 2025 23:45:42 +0000 (UTC) X-FDA: 83584671324.25.BE12474 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) by imf24.hostedemail.com (Postfix) with ESMTP id 4E9C9180005 for ; Sun, 22 Jun 2025 23:45:40 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b="TOXiZ/oT"; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf24.hostedemail.com: domain of andreyknvl@gmail.com designates 209.85.221.41 as permitted sender) smtp.mailfrom=andreyknvl@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1750635940; a=rsa-sha256; cv=none; b=x7u2lUKq2ej6D7+VgL4w1p/5sj6cMJ+4Y24JK4RD/iJfLp6gDs17unqudkRI6iBM+SAOEY p0R7322pjDQh9KgkVsE2+yxgaddSTRqvd6SY0OdLwmpYckiZS6euwxU+oWGV/7Jfw+oba+ zxTUwaGFOw5leuZEd1uGM39Q5cZUQAI= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b="TOXiZ/oT"; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf24.hostedemail.com: domain of andreyknvl@gmail.com designates 209.85.221.41 as permitted sender) smtp.mailfrom=andreyknvl@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1750635940; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=AfRSgbFZSy5dkhaBXEq2u/k7fzFxoV0b6ZxvQq5cauk=; b=ofSH02iChYyPTy/2zNq6VJtIPbIjO3yubq2E9/dN0vGKM8etK7KK6ZrL9tcjJMEC4b5Cet 5AYv9DkSlvgHtRGYJMyK1sFtGRwIS3NHaCrF4Xm4M+/TQuM+qRDwbVvASAeZra0yVitBT2 p/+BsPwVrt0SoqxQLbHhGzttEo00iU0= Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-3a536ecbf6fso1980130f8f.2 for ; Sun, 22 Jun 2025 16:45:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1750635939; x=1751240739; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=AfRSgbFZSy5dkhaBXEq2u/k7fzFxoV0b6ZxvQq5cauk=; b=TOXiZ/oTSD4UF7rYfWyeJ6RdU7fssRmcS0rZMNqYRDJhOFNn2sQLLzc/T9g0f23s2X r8mPzmO3IbHGUr9qoz21KwTtfmBwNJwpZDNwNVmkt2DQK96XgoQ++JBbwPO00lPk2Ygp ceuKRVFMyHQU/GkZqniMqq72ST7ZA9As+2kMiAb72jBpjj5UmkNSVpawINhmHyhty9CS as5/jWtQ1LiDDuoO4MNRL3iiKeL2eFdtGDViU8aGEpz1D4I59D34McxUkTFd9HhboYcT uZ9E/lAq1NLTtIMX0N41MpPm9LeKp8bcfEvfeTYJriz1801UvpjtO3HQCRt1T+wplK2O Y4YA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1750635939; x=1751240739; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=AfRSgbFZSy5dkhaBXEq2u/k7fzFxoV0b6ZxvQq5cauk=; b=d/xNiSUynZwyYLy2yGbYm64Yf5c1l8HuqyqUFGG6b1/fvdHli5P4n/VOk3mECNsZvS tc+eLIZrPlSs67q4e2FTMb1/P4zMpkGLqyA7fbnIiOIA0LThaQlijfvaajWRN0k59DaB E7PPzwkDpNtxZRkt71s1ABi6yl+FNRclNfrECISyzv3iIKgnJKmNUcM3NXLPAKRIwHof dp7hAR1ySeNHYXD6fTaZBP24fzrOcPCmvVvQe6T6p8AsAhoTZhkLxEQhljYXJGE0ADMx on6rFneGS/4i25Eqk7hccrsMo6PjLmh6AFc4NXSLuDBbArAU0DCehdwHU4Doi5SzJJ7X 8haw== X-Forwarded-Encrypted: i=1; AJvYcCV3RHlBIuEz5Ub8RmVkv+VBEerILPljnt57UyL0PRnlRI6wJB6C+OUKm5mppxY8hPgFgNOvmZ7LWA==@kvack.org X-Gm-Message-State: AOJu0Yx32bTovWs/KI9Q3i2/U3jNhMX2QxWqBu2ImoGI3lYDl7V9Vr4s rHB9TDzF1aIvoNeSWDX3BQObLWsPp1QFxrRVReGyyRiKvCtdbMDqsF3S8r8Hjql4waSLnQFZWBx XWGp4RM9283daZYrYY9rxI4hNPDeJj3A= X-Gm-Gg: ASbGncvr/sQOHgP2J5/vkgBG29hnC1KLepjkh+3syiHKzIPqsPRwAP/dkjUbqRJswey tnOPaXhmByCdSDUl2+oj1VXQyqcRp2i61w6I3SExLr2leoCLLnW5kUL1zrQktE7GuHGEP7I91ot 8j3F8LeqLQ07S/wrKoa4/ynG/DUpe0JsGl7Qv2dzfdkg8TPw== X-Google-Smtp-Source: AGHT+IHtMH20yLlfwi3w/7no5bDWf4VeH0DHMUuDCUAAEMpLhHI+Eo4qFXT+L771UDCTYftg0Xdc3Mrk8fARzS1E+YI= X-Received: by 2002:a05:6000:4812:b0:3a5:85cb:e9f3 with SMTP id ffacd0b85a97d-3a6d12fb438mr8377371f8f.12.1750635938566; Sun, 22 Jun 2025 16:45:38 -0700 (PDT) MIME-Version: 1.0 References: <20250622141142.79332-1-snovitoll@gmail.com> <20250622112014.76bdd8929ecdb1c1fb3015b5@linux-foundation.org> In-Reply-To: From: Andrey Konovalov Date: Mon, 23 Jun 2025 01:45:27 +0200 X-Gm-Features: Ac12FXwUkZLlD3Swe_7wD6CkEWUE3IVyAJ6jtFRMciaxOVoXB7zY_DK7oRwjgAQ Message-ID: Subject: Re: [PATCH v2] mm: unexport globally copy_to_kernel_nofault To: Sabyrzhan Tasbolatov , Andrew Morton Cc: arnd@arndb.de, david@redhat.com, dvyukov@google.com, elver@google.com, glider@google.com, hch@infradead.org, kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, ryabinin.a.a@gmail.com, vincenzo.frascino@arm.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspam-User: X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 4E9C9180005 X-Stat-Signature: zwiakkwcjnuzg9ddbq8bhucqojcnuyik X-HE-Tag: 1750635940-92456 X-HE-Meta: U2FsdGVkX1/9CPhsMaDJfNT7XyyaMRzBOav6WuVn+8ZRQSENyEjhMgT6Q7LlpVn+GA64ivDYUKbh/Nt+vPLWUXYATEJ2DfUjFPPv5/hDGofrqOMdrMCiyDonwSgFfRl1F0lRFUjkXiE/tCy9wWqAKrbFqLzugJ9dsGNVdB/jNeYBklsjUpbHNBgZbnVWHNptDX2vn82e+QDcGW30Kqt/K9YM2cW0p37OC13L2U9SHRXe7nzw2/1Z3/w3hG7sqlvoV/PBsoYFxBZuIpyK8abLIkvF9xr2imJriKpbMKyNobCdaZQa2/M7wDtVjTU5C8jTbhAnG1LNeMMceCWaWtEXEbtfw9Jhh1r9h5Uvi0dqhLCEddzfpjdkfO+O9xkD1GQoIy4iOxJSjIMCGjc8DU1nSe7XEtvFe7LcilBELIQWObI32r1KBycGk/qUglRZix0PCPsHBnwo4MRafBlDMGFg2IfQ5kx34okRn4pelyWJma2f04J5Z8EdVg2NSdlf7pkYOMxk6kyLClbr+JrqT3jb6xqudfPJYPJ/FOKbku4WMof1sH7PSlKca6w+iepUjXdQlzrKrmzvH7+8GouXEKEom5RB66qQjxNI6iKYDk1NBAp4zv/fsiVeKqijsSH9BwlYDMqwR9NIWePkduyhOvV1VZd3eEgZmVwxoRh32eQwr6FKdMz9I0KpOQDnSE2d2kDORA/lGxnA9HVTaM44iwc6vf2QvV9gL5GNuM0Rk1A01Y5ws+7jEvc8HGC27Z5RbLChxvD/FBAvrnRcjV8dXev3cCq4uwYiLk/w7G20sH2rCmcOQCGrqLRobaUKLk4UiYT7nMM9WETyjqc4CPG/k3jJG0hOBeEDZ6jfUXqdugtriKzOl8BiiEdZG2eeZ/gPxTrbsPCpz1oTtUDRjRT9svMipKzMFc4aj/BfMzcMa8qs0GvH3Vn/zz5tf6JC01c7+uIVhk1TRCwgYMEIWoCLEd6 umAFbLq7 4NCXe6gl4urPYgoKkIRGVuRBuGM5e1PyKzeZwQqH+DjDyRc/3bX2F+9dDBbB8eGjISZC447WmdrdEUuEhmpyGPmN7gjrccl1/6X54rx22itBH1wyyb1OtuSvOoFAEG2HqeL6jySbYd5+TBT4e5NxPLgujmFBV7U79mSiWGxpuzZ2Kr1FGI68kEydogG5lOnpoxRDuqwVRSv2XZWNoGC9pZtjfBKh/ozH9glG6iMX1FsSydzurGVVLy2EmIdAgD4Iob3prV+9sR2p5qlZuzThTaP2Vc/mioliLgZlXkcnFyBUjyBWzITIqz7DAAIsymCW/b4ORRC553AnjmxjsgTRCoLArx5DGsTaeF9/QYr0gE74cdUHYh/GgocNIdp6TpVQhLY5KJeHKj5VrXV1p6euRCBPkNuRO2Sw3ATq3BoB3WwDRSHlW23oiwHhJA3+BHlR6ICRRvE0lpT7hmXZL3XNBKVoKJj/NqzzWIRRoeb1zRZKQbs0s8u4y/cDKCS8EMBbc4Oxc X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Sun, Jun 22, 2025 at 9:09=E2=80=AFPM Sabyrzhan Tasbolatov wrote: > > I haven't verified this, but theoretically, it's a handy > =E2=80=9Cwrite-anywhere-safely=E2=80=9D ROP gadget. > Assume the attacker has already gained an arbitrary RW primitive > via a UAF/OOB bug. Instead of stitching together > prepare_kernel_cred() + commit_creds(), which is a common path > of using exported symbols to achieve privilege escalation. > This path needs two symbols and register juggling. > With exported copy_to_kernel_nofault() they can do this: > > /* Pseudocode of exploit for a ROP stage running in kernel context */ > struct cred *cred =3D leaked_pointer; > rop_call(copy_to_kernel_nofault, &cred->uid, &zero, 4) > > copy_to_kernel_nofault() disables page-faults around the write, > so even if cred corupts a guard-page, the write will not crash. Attacker can use copy_to_kernel_nofault without it being exported as well. So I'd say this patch is more of a clean-up of exports.