Messages in this thread |  | | From | Linus Torvalds <> | Date | Wed, 1 Jul 2020 13:25:36 -0700 | Subject | Re: objtool clac/stac handling change.. |
| |
On Wed, Jul 1, 2020 at 12:59 PM Al Viro <viro@zeniv.linux.org.uk> wrote: > > On Wed, Jul 01, 2020 at 12:04:36PM -0700, Linus Torvalds wrote: > > > > That's actually for the access granting. Shutting the access down ends > > up always doing the same thing anyway.. > > #define user_read_access_end prevent_current_read_from_user > #define user_write_access_end prevent_current_write_to_user > static inline void prevent_current_read_from_user(void) > { > prevent_user_access(NULL, NULL, ~0UL, KUAP_CURRENT_READ); > } > > static inline void prevent_current_write_to_user(void) > { > prevent_user_access(NULL, NULL, ~0UL, KUAP_CURRENT_WRITE); > } > > and prevent_user_access() has instances that do care about the direction...
Go and look closer.
There are three cases:
(a) the 32-bit book3s case. It looks like it cares, but when you look closer, it ends up not caring about the read side, and saving the "which address to I allow user writes to" in current->thread.kuap
(b) the nohash 32-bit case - doesn't care
(c) the 64-bit books case - doesn't care
So yes, in the (a) case it does make a difference between reads and writes, but at least as far as I can tell, it ignores the read case, and has code to avoid the unnecessary "disable user writes" case when there was only a read enable done.
Now, it's possible that I'm wrong, but the upshot of that is that even on powerpc, I think that if we just made the rule be that "taking a user exception should automatically do the 'user_access_end()' for us" is trivial.
But I'll add the powerpc people to the list too. And the arm64 people too, although it looks like they still haven't actually made the uaccess_disable() logic visible as user_access_begin/end and the unsafe_xyz code, so they'd not be impacted.
Christophe/Michael: the discussion is that I'd actually want to change the "exception on user access" case to do the user_access_end() automatically, so that you can write code like
if (!user_access_begin(...)) goto out;
unsafe_get_user(..., out); unsafe_get_user(..., out);
user_access_end(); .. all is good, use the value we got.. return 0;
out: return -EFAULT;
and use the same error label for both the "user_access_begin() failed" _and_ for the "oops, the access faulted".
Right now the code needs to explicitly do the user_access_end() handling manually if one of the accesses fault.
See for example fs/readdir.c, which has that
efault_end: user_write_access_end(); efault: buf->result = -EFAULT; return -EFAULT;
pattern of two different error targets several times. I'd like to avoid that user_{read_,write_,}access_end() case for the error handling entirely. It's extra complexity.
I checked every single non-arch user, and for all of them it was just extra work (eg i915 driver, readdir, select, etc)
The only case it wasn't an extra bother was the lib/strn{cpy,len}_from_user() cases, but that was because I literally organized the code to call a helper function be called in such a way that it always did the right thing.
Linus
|  |