Messages in this thread | | | Subject | Re: [PATCH] security/keyring: avoid pagefaults in keyring_read_iterator | From | Chris von Recklinghausen <> | Date | Fri, 25 Oct 2019 07:10:29 -0400 |
| |
On 10/21/2019 11:46 AM, Chris von Recklinghausen wrote: > On 10/21/2019 10:21 AM, David Howells wrote: >> Chris von Recklinghausen <crecklin@redhat.com> wrote: >> >>> The put_user call from keyring_read_iterator caused a page fault which >>> attempts to lock mm->mmap_sem and type->lock_class (key->sem) in the reverse >>> order that keyring_read_iterator did, thus causing the circular locking >>> dependency. >>> >>> Remedy this by using access_ok and __put_user instead of put_user so we'll >>> return an error instead of faulting in the page. >> I wonder if it's better to create a kernel buffer outside of the lock in >> keyctl_read_key(). Hmmm... The reason I didn't want to do that is that >> keyrings have don't have limits on the size. Maybe that's not actually a >> problem, since 1MiB would be able to hold a list of a quarter of a million >> keys. >> >> David >> > Hi David, > > Thanks for the feedback. > > I can try to prototype that, but regardless of where the kernel buffer > is allocated, the important part is causing the initial pagefault in the > read path outside the lock so __put_user won't fail due to a valid user > address but page backing the user address isn't in-core. > > I'll start work on v2.
Actually I'm going to back off on a v2 effort at this point and request that folks comment on the code as-is. Changing keyctl_read_key to use its own kernel buffer might be a worthwhile effort, but it doesn't appear to me to have any effects on preventing pagefaults on user pages at inopportune points of the code.
Thanks,
Chris
> > Thanks, > > Chris >
| |