| Message ID | 20200921143434.707844-5-hch@lst.de (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [01/11] compat.h: fix a spelling error in <linux/compat.h> | expand |
From: Christoph Hellwig > Sent: 21 September 2020 15:34 > > Explicitly check for the magic value insted of implicitly relying on > its numeric representation. Also drop the rather pointless unlikely > annotation. > > Signed-off-by: Christoph Hellwig <hch@lst.de> > --- > lib/iov_iter.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/lib/iov_iter.c b/lib/iov_iter.c > index d7e72343c360eb..a64867501a7483 100644 > --- a/lib/iov_iter.c > +++ b/lib/iov_iter.c > @@ -1709,8 +1709,7 @@ static ssize_t rw_copy_check_uvector(int type, > ret = -EINVAL; > goto out; > } > - if (type >= 0 > - && unlikely(!access_ok(buf, len))) { > + if (type != CHECK_IOVEC_ONLY && !access_ok(buf, len)) { > ret = -EFAULT; > goto out; > } > @@ -1824,7 +1823,7 @@ static ssize_t compat_rw_copy_check_uvector(int type, > } > if (len < 0) /* size_t not fitting in compat_ssize_t .. */ > goto out; > - if (type >= 0 && > + if (type != CHECK_IOVEC_ONLY && > !access_ok(compat_ptr(buf), len)) { > ret = -EFAULT; > goto out; > -- > 2.28.0 I've actually no idea: 1) Why there is an access_ok() check here. It will be repeated by the user copy functions. 2) Why it isn't done when called from mm/process_vm_access.c. Ok, the addresses refer to a different process, but they must still be valid user addresses. Is 2 a legacy from when access_ok() actually checked that the addresses were mapped into the process's address space? David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
On Mon, Sep 21, 2020 at 04:34:27PM +0200, Christoph Hellwig wrote: > Explicitly check for the magic value insted of implicitly relying on > its numeric representation. Also drop the rather pointless unlikely > annotation. See above - I would rather have CHECK_IOVEC_ONLY gone. The reason for doing these access_ok() in the same loop is fairly weak, especially since you are checking type on each iteration. Might as well do that in a separate loop afterwards.
On Mon, Sep 21, 2020 at 03:05:32PM +0000, David Laight wrote: > I've actually no idea: > 1) Why there is an access_ok() check here. > It will be repeated by the user copy functions. Early sanity check. > 2) Why it isn't done when called from mm/process_vm_access.c. > Ok, the addresses refer to a different process, but they > must still be valid user addresses. > > Is 2 a legacy from when access_ok() actually checked that the > addresses were mapped into the process's address space? It never did. 2 is for the situation when a 32bit process accesses 64bit one; addresses that are perfectly legitimate for 64bit userland (and fitting into the first 4Gb of address space, so they can be represented by 32bit pointers just fine) might be rejected by access_ok() if the caller is 32bit.
From: Al Viro > Sent: 21 September 2020 16:11 > On Mon, Sep 21, 2020 at 03:05:32PM +0000, David Laight wrote: > > > I've actually no idea: > > 1) Why there is an access_ok() check here. > > It will be repeated by the user copy functions. > > Early sanity check. > > > 2) Why it isn't done when called from mm/process_vm_access.c. > > Ok, the addresses refer to a different process, but they > > must still be valid user addresses. > > > > Is 2 a legacy from when access_ok() actually checked that the > > addresses were mapped into the process's address space? > > It never did. 2 is for the situation when a 32bit process > accesses 64bit one; addresses that are perfectly legitimate > for 64bit userland (and fitting into the first 4Gb of address > space, so they can be represented by 32bit pointers just fine) > might be rejected by access_ok() if the caller is 32bit. Can't 32 bit processes on a 64bit system access all the way to 4GB? Mapping things by default above 3GB will probably break things. But there is no reason to disallow explicit maps. And in any case access_ok() can use the same limit as it does for 64bit processes - the page fault handler will sort it all out. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
diff --git a/lib/iov_iter.c b/lib/iov_iter.c index d7e72343c360eb..a64867501a7483 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -1709,8 +1709,7 @@ static ssize_t rw_copy_check_uvector(int type, ret = -EINVAL; goto out; } - if (type >= 0 - && unlikely(!access_ok(buf, len))) { + if (type != CHECK_IOVEC_ONLY && !access_ok(buf, len)) { ret = -EFAULT; goto out; } @@ -1824,7 +1823,7 @@ static ssize_t compat_rw_copy_check_uvector(int type, } if (len < 0) /* size_t not fitting in compat_ssize_t .. */ goto out; - if (type >= 0 && + if (type != CHECK_IOVEC_ONLY && !access_ok(compat_ptr(buf), len)) { ret = -EFAULT; goto out;
Explicitly check for the magic value insted of implicitly relying on its numeric representation. Also drop the rather pointless unlikely annotation. Signed-off-by: Christoph Hellwig <hch@lst.de> --- lib/iov_iter.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)