From patchwork Mon Sep 2 05:31:29 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Omar Sandoval X-Patchwork-Id: 13786723 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88B26CA0ED3 for ; Mon, 2 Sep 2024 05:31:55 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0FCF38D0078; Mon, 2 Sep 2024 01:31:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 087468D002D; Mon, 2 Sep 2024 01:31:54 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E1BE98D0078; Mon, 2 Sep 2024 01:31:53 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id B6F7F8D002D for ; Mon, 2 Sep 2024 01:31:53 -0400 (EDT) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 5702E41678 for ; Mon, 2 Sep 2024 05:31:53 +0000 (UTC) X-FDA: 82518676506.28.73B53D0 Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) by imf13.hostedemail.com (Postfix) with ESMTP id 9518F20004 for ; Mon, 2 Sep 2024 05:31:51 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=osandov-com.20230601.gappssmtp.com header.s=20230601 header.b=cKyyf87I; dmarc=none; spf=none (imf13.hostedemail.com: domain of osandov@osandov.com has no SPF policy when checking 209.85.210.170) smtp.mailfrom=osandov@osandov.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1725255007; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=uGf5OeNLuW8N0+HtKDB4O6h1a0pvH1iiorPowhbhX1k=; b=A0xV8wAfKPSpcGZA1LmKUWyigxf6uGRg5nZg75Bvs1Fjus2DW0esjU+Uj3tyKjXG0vWk4C rbjm1a2R6fj71jlhOfGi6yKzNYUbWPdPr9zY6EMJAPWzGh4YEOIlahPamVEcyvRVlZ84df MHIP9lN3aDFTNJIqAbjo6RBP4CoamCU= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1725255007; a=rsa-sha256; cv=none; b=7olwzlcky3PY17d6kDAZShXzCjJehi7Y/eUTCSOtb94LTj/i2r3iXt93m8ZS3C6wtns7Ws x5fPvTi/fSoHdDXJ0yn5l4nvrV7NswAbT+Oy/XsrAwSeM4lsrYGRJXDYdCwcaIaRZER8pN M8zPrzBzf/54ikKnsgfutjwM71r7RBQ= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=osandov-com.20230601.gappssmtp.com header.s=20230601 header.b=cKyyf87I; dmarc=none; spf=none (imf13.hostedemail.com: domain of osandov@osandov.com has no SPF policy when checking 209.85.210.170) smtp.mailfrom=osandov@osandov.com Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-71446767885so457217b3a.1 for ; Sun, 01 Sep 2024 22:31:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osandov-com.20230601.gappssmtp.com; s=20230601; t=1725255110; x=1725859910; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=uGf5OeNLuW8N0+HtKDB4O6h1a0pvH1iiorPowhbhX1k=; b=cKyyf87IzhFDsCRt+ezI16uLUmrofrFbB+CzST0+JZlwd7DpojkVCdYbjRssNUFc0z ODGJwz/U5jUmrQ/9qShadroxEtT8SawZ/MQMHO/4Pw+Hok88lfkqCP55HwBZeMx/eNrz buz5IoQxyyaiHx9Nin02RCmZ6MDzLLH9C9miv6/580eyRe4QlnpcYqDwdai/A7Ic56kL MsYskaudTgh6LO+FGgD2923azi9FvjArfkBXkUgnp5wDAWWe2uB8xnO6rskPkO/EohRe cZOKZI/ut36yBKj0SL3p+dFk3FwiecMVwDe1EcxCSM6XG8+7fd59SdyD1GsX75kaeSiX mOWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725255110; x=1725859910; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=uGf5OeNLuW8N0+HtKDB4O6h1a0pvH1iiorPowhbhX1k=; b=YdiDO+xklGMoiLZC/isSM2/8QVXsEndcko+OuhTDaUmfrg00SewFUsFw/LsF3sB74+ ArjTMEHMVjrDJtV0q+FHk8nM/bBLBqUJM7XyL/pFwboJE1ixcXOgRJ2fIRsu47mpnlMh rtregCH1SUErxvwpqZsjW7fYtYODRNZ9KxfIY9lcmnP2dpwdfWjVc8HMKNqmKrX07Z3E tmd+dKWNxLj+Rs8XogztvxHFF//H4eKBIm5KsB30oOENzWS2abcpilkCxNkjgxcGdU/m 7oU3NgPhqP6gRhbgXuuGA6oXS6KBUsXDPO/h+SgjzGtwIjLkKfWgx+dVm8dOS7aeGgoz FAPQ== X-Gm-Message-State: AOJu0Yzu4pfrL7tw2rVKwkqj0/1DyI4Z/Lf8oT6J78/VmejOCYPiiKV8 GyYBXgXo3ZdmubFGaqqxUqP1sdolgMagmcdBeheAk1vpk5K6lWPXvS6+FvfdlYCzPf89+L7qdgd 8 X-Google-Smtp-Source: AGHT+IHSXT1zDdfdFgGYC0SrD/pcgNSgiiEyyPyOddsLA1njvCrWFZrUbt+epCA0PEHogZAdapDSkA== X-Received: by 2002:a05:6a00:2d18:b0:70d:2289:4c55 with SMTP id d2e1a72fcca58-717307cbc90mr5477602b3a.5.1725255109933; Sun, 01 Sep 2024 22:31:49 -0700 (PDT) Received: from telecaster.hsd1.wa.comcast.net ([2601:602:8980:9170::901f]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-715e55a692fsm6076279b3a.60.2024.09.01.22.31.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 01 Sep 2024 22:31:49 -0700 (PDT) From: Omar Sandoval To: linux-mm@kvack.org, Andrew Morton Cc: Christoph Hellwig , x86@kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, loongarch@lists.linux.dev, linux-mips@vger.kernel.org, linux-parisc@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-um@lists.infradead.org, kernel-team@fb.com Subject: [PATCH 2/2] mm: make copy_to_kernel_nofault() not fault on user addresses Date: Sun, 1 Sep 2024 22:31:29 -0700 Message-ID: X-Mailer: git-send-email 2.46.0 In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 9518F20004 X-Stat-Signature: ztwudb6oeoh3tj9e9jeb9eota85nt6za X-Rspam-User: X-HE-Tag: 1725255111-527354 X-HE-Meta: U2FsdGVkX190qpROVLyPUhyBLWhfbu7uwUe776E6/a9XrUAQ4nh81sKC/dIR5b7UJ1N13oJBYXHPulMaiKruwoXEXcPg2mERcm9EachfxBMfsNEm43Lx5NFLuXk/fxbtc5uhVBWUFKv7XW+zAhdlHGxJn+r+LyN3uF3xnagRgPaPicW7Ckq2GvVgVMcB9Y2+XevLIqez2bgFj4JEZvGbI/38vRVOsNT7v9LEi79yJ+FSNcJa9tX2DZdLIjuVe/HkzGhBee/6qRMqwgmoxY0obPe3oa8HOkur5cML3DbLnM3EbZvfi7YzwfL+z0u7ZJcZshwraU2Gexp7KGqMYrM96snKrs3nkabbE2xcNLRHWfT/YzUjhVzZev3bP49L6soM8+qMrrSJ2AVKWB94DyqXh7+KpTsDfXGGnZNdUY2hP5wC3ZOhgo7PVFQOPUbDjHFnD4YSA+hoOMOCBB5+ESvD0bAU3S+AeDw0nZBMkCSFotuA/NfWkyXjcocz8XuDzijhLj9MC2J/FUf5jf/KntP8SoM+KcOas1ZtjMvZ9ZQB2V9WwXNln2cWfI30ZLkbxp3K0nE7XA6ScGGEkxjUjAisCNYIZ7EJwLV0MRnOnp85Lt2GK4NhXSpxVmc6N5nJvaaNAYSpXJ+ztVo60eXSYtqM1IqLEJVinVvwIahmuS3jF/n02MW5aYeK2dQoMeBPgplCHxXWZB7i1W+d2VZIBq7FtXI+efLwZpov+Yh2+v9ZigPydimHbJt67mS8qXmhqkU+fDEqfFk7G7OfWEapQrIJtcaQQlTjcHLguB1F4PUrrlIIPkcZI7YgZXCEx2OKNXjVn5tngBJA7m1HWS2BC8BhKegkzscMBj3lJxuPFtQ9r9DGDoF+nAdtHODIsCSyLGYVNmCMxgaA41IDeg366k8zojF1c4x4koH9ygsAVqrJ6nmRVq0AcK+luMsV5pjay1BZRKAcQ1YrFkLa2qIM/4f /DQsmYbQ o84jWV8qJzhOSAs5knDe6SFz3hxphRz90fBpL/5ECu6QN6iMMnTJPcWk7xnci4jpdd5K5MnBijzVpGTXGIXTUXDxlk6p0mxo1+H+GcSl0nRLMZBQctNr6ujc7OVGqzewJrB9o05r0CgTg1Dm08bovafcxadyY+JF/aFTmkXyTlpAx3bRvmVsEuN6hprRzKWGoH8pnO6IxfwAKbuZQ3deHcX9sVEcmr1+HBgnTSt0Tav+9xABC3AzXX26FbVEoNDzIXYKSTBzk+UrGsDhjvPjZnRv//+WuuSUZZfiiUqo/ZWUKBzSms04AD+vtj2u0mAlVoTg+v9taoZ8sJOlszMYIV/hmVETDhJSgxyoSSXAOUc437ZfQYSv6b5vyP+4BQ/bbgoaYLO2DlcoZNE1K6T1fQrvadohJhB00rUmV6ohQOBoIcOanGpPGR3ivjAxTdBJwj/n9VImH9Iq0TNBLXFHp3R/H8Q== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Omar Sandoval I found that on x86, copy_to_kernel_nofault() still faults on addresses outside of the kernel address range (including NULL): # echo ttyS0 > /sys/module/kgdboc/parameters/kgdboc # echo g > /proc/sysrq-trigger ... [15]kdb> mm 0 1234 [ 94.652476] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 94.652481] #PF: supervisor write access in kernel mode [ 94.652483] #PF: error_code(0x0002) - not-present page [ 94.652485] PGD 0 P4D 0 [ 94.652489] Oops: Oops: 0002 [#1] PREEMPT SMP PTI [ 94.652493] CPU: 15 UID: 0 PID: 619 Comm: bash Not tainted 6.11.0-rc6 #11 [ 94.652497] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 94.652498] RIP: 0010:copy_to_kernel_nofault+0x1c/0x90 [ 94.652505] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 65 48 8b 0d 14 9d 72 4c 83 81 04 1b 00 00 01 48 83 fa 07 76 18 48 8b 06 <48> 89 07 48 83 ea 08 48 83 c7 08 48 83 c6 08 48 83 fa 07 77 e8 48 [ 94.652507] RSP: 0018:ffffa4a640b1fa48 EFLAGS: 00010002 [ 94.652509] RAX: 00000000000004d2 RBX: 0000000000000003 RCX: ffff8a8251020000 [ 94.652510] RDX: 0000000000000008 RSI: ffffa4a640b1fa68 RDI: 0000000000000000 [ 94.652512] RBP: 0000000000000000 R08: ffffa4a640b1f9f0 R09: ffffa4a640b1f9f8 [ 94.652513] R10: 000000000000000a R11: f000000000000000 R12: 0000000000000000 [ 94.652515] R13: 00000000000004d2 R14: 0000000000000000 R15: ffff8a8251020000 [ 94.652518] FS: 00007fa9c15f6b80(0000) GS:ffff8a895f7c0000(0000) knlGS:0000000000000000 [ 94.652520] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.652521] CR2: 0000000000000000 CR3: 000000010ff72004 CR4: 0000000000770ef0 [ 94.652522] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 94.652523] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 94.652524] PKRU: 55555554 [ 94.652525] Call Trace: [ 94.652528] [ 94.652534] ? __die+0x24/0x70 [ 94.652538] ? page_fault_oops+0x15a/0x480 [ 94.652543] ? kdb_msg_write.part.0+0x3e/0xb0 [ 94.652547] ? vkdb_printf+0x1a6/0x8b0 [ 94.652550] ? exc_page_fault+0x72/0x160 [ 94.652555] ? asm_exc_page_fault+0x26/0x30 [ 94.652564] ? copy_to_kernel_nofault+0x1c/0x90 [ 94.652566] kdb_putarea_size+0x15/0x80 [ 94.652570] kdb_putword+0x72/0xc0 [ 94.652573] kdb_mm+0xdc/0x130 [ 94.652576] kdb_parse+0x2b7/0x6c0 [ 94.652578] ? kdb_getstr+0x40a/0x910 [ 94.652581] kdb_main_loop+0x4a0/0xa40 [ 94.652584] ? module_event+0x10/0x10 [ 94.652590] kdb_stub+0x1ae/0x3f0 [ 94.652594] kgdb_cpu_enter+0x2a8/0x5f0 [ 94.652599] kgdb_handle_exception+0xbd/0x100 [ 94.652605] __kgdb_notify+0x30/0xd0 [ 94.652610] kgdb_notify+0x15/0x30 [ 94.652612] notifier_call_chain+0x5b/0xd0 [ 94.652618] notify_die+0x53/0x80 [ 94.652622] exc_int3+0xf9/0x130 [ 94.652626] asm_exc_int3+0x39/0x40 Note that copy_to_kernel_nofault() uses pagefault_disable(), but it still faults. This is because with Supervisor Mode Access Prevention (SMAP) enabled, do_user_addr_fault() Oopses on a fault for a user address from kernel space _before_ checking faulthandler_disabled(). copy_from_kernel_nofault() avoids this by checking that the address is in the kernel before doing the actual memory access. Do the same in copy_to_kernel_nofault() so that we get an error as expected: # echo ttyS0 > /sys/module/kgdboc/parameters/kgdboc # echo g > /proc/sysrq-trigger ... [17]kdb> mm 0 1234 kdb_putarea_size: Bad address 0x0 diag: -21: Invalid address Signed-off-by: Omar Sandoval --- mm/maccess.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/maccess.c b/mm/maccess.c index 72e9c03ea37f..d67dee51a1cc 100644 --- a/mm/maccess.c +++ b/mm/maccess.c @@ -61,6 +61,9 @@ long copy_to_kernel_nofault(void *dst, const void *src, size_t size) if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)) align = (unsigned long)dst | (unsigned long)src; + if (!copy_kernel_nofault_allowed(dst, size)) + return -ERANGE; + pagefault_disable(); if (!(align & 7)) copy_to_kernel_nofault_loop(dst, src, size, u64, Efault);