From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2A39ECAAD3 for ; Mon, 19 Sep 2022 14:46:52 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 47CE4940007; Mon, 19 Sep 2022 10:46:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 42B426B0072; Mon, 19 Sep 2022 10:46:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2F3B5940007; Mon, 19 Sep 2022 10:46:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 1C8526B0071 for ; Mon, 19 Sep 2022 10:46:52 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id DF0B5A69B1 for ; Mon, 19 Sep 2022 14:46:51 +0000 (UTC) X-FDA: 79929111822.11.617B5CF Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf14.hostedemail.com (Postfix) with ESMTP id 9797B10000B for ; Mon, 19 Sep 2022 14:46:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=Ce3z96Js4LblxY5GROf+dxFvOAIV9SCqQWmJq0OtdtQ=; b=vSGtfB9YKERIyQrYTSjZ55U2gE TWBwcP7KMMvUwB1p6Sed9omokTt09xfC8Qy6BNR4kIxwnex9L9vdPVO1SWHnn7o0cD0Oj1tPWGuEo P6Z1HbOd72vni2tci7W7nl4FF+7BXfsS0iw3Dj39+aR36KeUi+uOGZ/p9W/9jHrUSlkbqdZlBAPtt LyqBzXtgU+Wam/XDyijoi3GjytkxszSwGq/RG4pSghV3ugangfI6cHJy/swlUlzE2vGXFpxrPEyUU IDmAGT45DdSi6on+e7EMdBfR2GqwrqtD1PVxOElaXUDK5zvehVO4+jI9wsGHQ12EoS852WGnSg/x3 os5LmJvQ==; Received: from j130084.upc-j.chello.nl ([24.132.130.84] helo=noisy.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.94.2 #2 (Red Hat Linux)) id 1oaI2k-004mep-Or; Mon, 19 Sep 2022 14:46:43 +0000 Received: from hirez.programming.kicks-ass.net (hirez.programming.kicks-ass.net [192.168.1.225]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (Client did not present a certificate) by noisy.programming.kicks-ass.net (Postfix) with ESMTPS id BDA9F300202; Mon, 19 Sep 2022 16:46:39 +0200 (CEST) Received: by hirez.programming.kicks-ass.net (Postfix, from userid 1000) id A2DB32BAC7765; Mon, 19 Sep 2022 16:46:39 +0200 (CEST) Date: Mon, 19 Sep 2022 16:46:39 +0200 From: Peter Zijlstra To: Andrew Morton Cc: Kees Cook , Matthew Wilcox , Uladzislau Rezki , Yu Zhao , dev@der-flo.net, Ingo Molnar , linux-kernel@vger.kernel.org, x86@kernel.org, linux-perf-users@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org, linux-arch@vger.kernel.org Subject: Re: [PATCH 0/3] x86/dumpstack: Inline copy_from_user_nmi() Message-ID: References: <20220916135953.1320601-1-keescook@chromium.org> <20220916125723.b4c189d09bcd8fd211a73c32@linux-foundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220916125723.b4c189d09bcd8fd211a73c32@linux-foundation.org> ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1663598810; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Ce3z96Js4LblxY5GROf+dxFvOAIV9SCqQWmJq0OtdtQ=; b=x4Y7ziE4x3mlKN7aDC1/RB/gxlKlJp+Wd5N/xGXL9Wvj2005BmKpQ/ZeNnnbR2ZXCG1Uyt o/ZKjCUYVP2eeToTvTCY17NJeI2U8s1/vaPfj8xKA++RLulU/TYLJOIgWKHCuAerDDdE3q CrcZw0Zve2kuVPpGgIw2xIjOmX5t1GU= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=vSGtfB9Y; spf=none (imf14.hostedemail.com: domain of peterz@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=peterz@infradead.org; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1663598810; a=rsa-sha256; cv=none; b=cAicC4Xjbj5GBrTmA1gGmEXAUqP5RBT0+9WDJXC2nslSIQbysDn7jLEcuWxrRPQsBRah4S JMv3rFtSkTa+iWwUT0DLkex2pMOxB43vX14N2R3Hb+rQ2mXZwaZmh6xlHPBg2WcEvcRwCR khro60U9SVt0WLXbPZ4NbliKpFovmzA= X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 9797B10000B X-Rspam-User: Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=vSGtfB9Y; spf=none (imf14.hostedemail.com: domain of peterz@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=peterz@infradead.org; dmarc=none X-Stat-Signature: 9geekth3aupwsy47u1aapp41aqwuk8jb X-HE-Tag: 1663598810-716413 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Sep 16, 2022 at 12:57:23PM -0700, Andrew Morton wrote: > On Fri, 16 Sep 2022 06:59:51 -0700 Kees Cook wrote: > > > Hi, > > > > This fixes a find_vmap_area() deadlock. The main fix is patch 2, repeated here: > > > > The check_object_size() helper under CONFIG_HARDENED_USERCOPY is > > designed to skip any checks where the length is known at compile time as > > a reasonable heuristic to avoid "likely known-good" cases. However, it can > > only do this when the copy_*_user() helpers are, themselves, inline too. > > > > Using find_vmap_area() requires taking a spinlock. The check_object_size() > > helper can call find_vmap_area() when the destination is in vmap memory. > > If show_regs() is called in interrupt context, it will attempt a call to > > copy_from_user_nmi(), which may call check_object_size() and then > > find_vmap_area(). If something in normal context happens to be in the > > middle of calling find_vmap_area() (with the spinlock held), the interrupt > > handler will hang forever. > > > > The copy_from_user_nmi() call is actually being called with a fixed-size > > length, so check_object_size() should never have been called in the > > first place. In order for check_object_size() to see that the length is > > a fixed size, inline copy_from_user_nmi(), as already done with all the > > other uaccess helpers. > > > > Why is this so complicated. > > There's virtually zero value in running all those debug checks from within > copy_from_user_nmi(). > > --- a/arch/x86/lib/usercopy.c~a > +++ a/arch/x86/lib/usercopy.c > @@ -44,7 +44,7 @@ copy_from_user_nmi(void *to, const void > * called from other contexts. > */ > pagefault_disable(); > - ret = __copy_from_user_inatomic(to, from, n); > + ret = raw_copy_from_user(to, from, n); > pagefault_enable(); > > return ret; I'm with Andrew here; this looks a *LOT* saner than all the other stuff.