| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
fix_alignment() already reads the instruction with
copy_inst_from_kernel_nofault() when the PC is a kernel address, and
only uses __get_user_instr() when it is not. That pointer is an
ordinary user address, so read it with get_user_instr(). On powerpc
__get_user() already does might_fault() and opens user access for the
read itself, so the only difference is the address check.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
setup_trampoline() writes the seven words of the on-stack sigreturn
trampoline with __put_user(), relying on the frame having been checked
when the frame setup opened its user write access. It is called after
that access has been closed again, so each of the seven writes opens and
closes user access on its own.
Write them inside one scoped_user_write_access_size() covering the
whole trampoline instead. Everything in it is a store, so a write-only
window is enough, and the instruction cache flush stays outside it.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
swapcontext and rt_sigreturn read the signal mask with
__get_user_sigset(), and rt_sigreturn also reads the MSR and uc_link
words of the transactional-memory path, each with one __get_user()
after an access_ok() on the whole context.
Make the helper get_user_sigset(), built on get_user(), and use
get_user() for the other two. On powerpc __get_user() already does
might_fault() and opens user access for the read itself, so the only
difference is the address check, which these pointers pass anyway.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
A few places in the 32-bit and compat signal code read a single field
with __get_user(): the uc_regs and MSR words in swapcontext and the
transactional-memory sigreturn and setcontext paths, and uc_link in
rt_sigreturn. They are not part of a run of accesses, and either rely
on an earlier access_ok() or on compat pointers being below 4GB.
Use get_user(). On powerpc __get_user() already does might_fault() and
opens user access for the read itself, so the only difference is the
address check, which these pointers pass anyway.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
kvm_htab_read() and kvm_htab_write() check the user buffer with
access_ok() once and then move each HPT entry with two __put_user() or
__get_user() calls, with real work between entries. Each of those
accesses opens and closes user access on its own, so the up-front check
saves nothing.
Use put_user() and get_user(). On powerpc the only difference is the
address check: __get_user() and __put_user() already do might_fault().
kvm_htab_write() holds mmu_setup_lock across the loop, but it already
reads each header with __copy_from_user() under that lock, so nothing
new happens under it. The access_ok() calls stay.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
lpc_debug_read() and lpc_debug_write() check the user buffer with
access_ok() once and then move it one access at a time with
__put_user() or __get_user(), with an OPAL call in between each. Each
of those accesses opens and closes user access on its own, so the
up-front check saves nothing.
Use put_user() and get_user(). The access_ok() stays, so a bad buffer
still fails before any LPC cycle is done.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
On s390 user space is a separate address space, so access_ok() has
nothing to check, and get_user() and put_user() are __get_user() and
__put_user() plus might_fault(). The remaining callers can use the
normal accessors directly:
- signal frame setup writes the back chain, the signal number and the
ucontext header in process context;
- the user stack walker for stack traces and perf callchains already
runs under pagefault_disable(), where might_fault() returns early;
- the general register set writer for ptrace runs in the tracer's
process context with no locks held.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The generic epoll_put_uevent() writes the two fields of each event
inside scoped_user_write_access_size(). The ARM override, which also
handles the packed OABI layout, still does it with __put_user(), relying
on the access_ok() that ep_check_params() does on the whole array.
Do it the same way as the generic version, for both layouts. ARM has no
user_access_begin(), so the accesses are the same as before.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The signal frame is checked with access_ok() once, in get_sigframe(),
and a few of its fields are then written with __put_user(): the ucontext
flags and link, the end marker after the coprocessor state, and the
sigreturn trampoline words.
Use scoped_user_write_access() with unsafe_put_user() where there are
several writes in a row, and put_user() for the two single ones. ARM
has no user_access_begin(), so the scopes are the same access_ok() and
the same accesses as before.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
When a task has FDPIC_FUNCPTRS in its personality, setup_return() treats
the signal handler as a pointer to a function descriptor and reads the
entry point and GOT pointer from it with __get_user(). Nothing checks
that pointer: it is whatever the task passed to sigaction(), and any
task can set FDPIC_FUNCPTRS with personality(2). BINFMT_ELF_FDPIC is
not limited to !MMU on ARM.
On most configurations this is harmless only by accident. With
CPU_SPECTRE (ARMv7) __get_user() is get_user(). With CPU_USE_DOMAINS
(ARMv5 and older) it uses the unprivileged ldrt, but that only stops at
kernel memory when software PAN has put the kernel domain in client
mode; with ARM_PAN=n the kernel domain stays in manager mode, where
permissions are not checked. So on an ARMv6-only MMU kernel, or an
ARMv5 or older one without ARM_PAN, it reads two words of kernel memory
that end up in the task's PC and r9.
Use get_user(), which checks the address. This goes back to commit
5c16595353e0 ("ARM: signal handling support for FDPIC_FUNCPTRS
functions").
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Before EV6, a load into $31 or $f31 could fault, so do_page_fault()
reads the faulting instruction and skips it if it is such a prefetch.
The PC can be a user or a kernel address, since the check runs for
faults from either mode, and it reads it with __get_user() either way.
That only works because alpha's __get_user() does no address check. It
also ignores the error, relying on the fault fixup zeroing the
instruction, which does not decode as a prefetch.
Move the check into is_prefetch(), and read the instruction with
get_user() for a user-mode PC and get_kernel_nofault() for a kernel one.
A failed read now explicitly means "not a prefetch".
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
show_registers() dumps the stack and the code around the PC, but only
for a kernel-mode fault, and only after checking that each address is
at or above PAGE_OFFSET. Both are kernel addresses that may not be
mapped.
It reads them with __get_user(), which predates get_kernel_nofault(),
the interface for exactly this: a kernel address that may not be mapped,
read with page faults disabled.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
dik_show_code() dumps the instructions around the PC when the kernel
dies. Both callers, die_if_kernel() and the kernel unaligned-access
handler, only get there for a kernel-mode PC: die_if_kernel() returns
early for user mode, and user-mode unaligned traps go to
do_entUnaUser() instead.
It reads that kernel text with __get_user() through a cast to a user
pointer. That works only because alpha's __get_user() does no address
check, and it predates get_kernel_nofault(), which is the interface for
exactly this: a kernel address that may not be mapped, read with page
faults disabled.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
rt_setup_ucontext() and rt_restore_ucontext() move the saved registers
with __put_user() and __get_user(), OR-ing the errors together, relying
on the access_ok() done on the whole frame by setup_rt_frame() and
do_rt_sigreturn(). setup_rt_frame() writes the ucontext flags and link
the same way.
Do those accesses inside scoped_user_{write,read}_access() instead, with
unsafe_{put,get}_user(). The gregs pointer is now derived inside each
scope, from the pointer the scope checked. restore_altstack() is called
after the scope. The access_ok() calls stay: do_rt_sigreturn() still
needs its own for the __copy_from_user() of the signal mask.
A fault part way through now stops at the first failing access instead
of carrying on. Either way the task gets SIGSEGV. nios2 has no
user_access_begin(), so the accesses themselves are the same as before.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
setup_rt_frame() never checks that the signal frame it builds is in
user space. The frame address comes from the user stack pointer (or
the alternate signal stack), and nios2's __put_user() is a plain store
with no address check. The kernel runs in supervisor mode above
TASK_SIZE, so those stores succeed.
The errors are OR-ed together and the frame setup carries on, so even
though copy_siginfo_to_user() fails its own check, the ucontext header
and every saved register are still written. A task that points its
stack pointer at kernel memory and takes a signal gets its own register
values written there.
Check the whole frame with access_ok() before writing any of it, as the
sigreturn side already does. This goes back to the original nios2
signal code in commit b53e906d255d ("nios2: Signal handling support").
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
setup_sigcontext() and restore_sigcontext() move the saved registers
with __put_user() and __get_user(), OR-ing the errors together, relying
on the access_ok() done on the whole frame by setup_rt_frame() and
sys_rt_sigreturn(). setup_rt_frame() writes the two trampoline magic
words the same way.
Do those accesses inside scoped_user_{write,read}_access() instead, with
unsafe_{put,get}_user() and unsafe_copy_{to,from}_user() for the block
of general registers. The access_ok() calls stay, for the
__copy_to_user() and __copy_from_user() of the signal mask.
A fault part way through now stops at the first failing access instead
of carrying on. On sigreturn this also means the general registers are
no longer zero-filled past the fault, and the user PC is not updated.
Either way the task gets SIGSEGV. hexagon uses the asm-generic
accessors and has no user_access_begin(), so the accesses themselves
are the same as before.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
setup_sigcontext() writes the whole register set with __put_user() and
__copy_to_user(), OR-ing the errors together, relying on its callers'
access_ok() on the frame. setup_frame() and setup_rt_frame() write the
sigreturn trampoline, and setup_rt_frame() the ucontext header, the
same way.
Do those writes inside scoped_user_write_access() with
unsafe_put_user() and unsafe_copy_to_user(). on_sig_stack() is
evaluated before the scope, and the instruction cache flush stays
outside it. The up-front access_ok()
calls stay: setup_rt_frame() still needs its own for the
__copy_to_user() of the signal mask.
A fault part way through now stops at the first failing write instead of
carrying on. Either way the frame setup fails and the task gets
SIGSEGV. alpha has no user_access_begin(), so the accesses themselves
are the same as before.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
restore_sigcontext() reads the whole saved register set with
__get_user() and __copy_from_user(), OR-ing the errors together. It
relies on its callers having done access_ok(): do_sigreturn() on the
sigcontext, do_rt_sigreturn() on the enclosing ucontext.
Make it do its own check, with a scoped_user_read_access() around
unsafe_get_user() and unsafe_copy_from_user(). do_sigreturn() then only
needs the same for the signal mask. do_rt_sigreturn() keeps its
access_ok(), which its own __copy_from_user() of the mask still needs.
A fault part way through the frame now stops the restore there, instead
of carrying on with zeroes and still writing the user stack pointer.
Either way the sigreturn fails and the task gets SIGSEGV. alpha has no
user_access_begin(), so the accesses themselves are the same as before.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
osf_sigaction() does one access_ok() on each user structure and then
reads or writes its fields with __get_user() or __put_user(), the same
pattern as the generic old-style sigaction().
Convert it the same way, to scoped_user_{read,write}_access() with
unsafe_{get,put}_user(). alpha has no user_access_begin(), so the
scope is the same access_ok() followed by the same plain accesses, and
the generated code does not change.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Nothing that builds on x86 uses __get_user() or __put_user() any more.
They were the "unchecked" user accessors: no range check, on the
assumption that the caller had already done an access_ok(). That
stopped buying anything once every user access had to be enabled and
disabled on its own, and on x86 __get_user() had become slower than
get_user(), since it does an lfence where get_user() checks the address
with a couple of plain instructions. Several of the last users were
also relying on them for things they were never meant to do: accessing
kernel addresses, or staying quiet in atomic context.
Remove the macros and the out-of-line __{get,put}_user_nocheck_N helpers
behind them, so that new users cannot appear.
Other architectures still provide their own versions. UML gets its
accessors from asm-generic and is not affected. arm64's __get_user()
and __put_user() have always been the same as get_user() and put_user(),
so there is no hurry there.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
vc_read_mem() and vc_write_mem() access the memory operand of an
emulated MOVS or INS/OUTS. That address may be a kernel address or a
user one, and the access must be a single MOV rather than a string
instruction, since the operand can itself be MMIO and take a nested #VC.
The code used __get_user() and __put_user() for this, on the grounds
that they do no pointer checks. That is a side effect of how x86
happens to implement them, not something they are for, and they are
going away.
Replace them with two local helpers that say what this is: a "user or
kernel" access with fault handling. They enable user access by hand
rather than through user_access_begin(), whose range check would reject
a kernel address, and use unsafe_get_user() and unsafe_put_user() for
the single MOV and its exception table entry. The read side uses
__uaccess_begin_nospec(), keeping the lfence that __get_user() used to
provide.
The old comment also claimed this always runs in atomic context, so the
page fault handler would not try to handle a fault. That holds when the
exception comes from kernel mode, where the handler runs as an NMI. It
does not hold when it comes from user mode, where the handler only has
interrupts disabled and so is not in_atomic(). A user-mode "rep insb"
into a not-yet-faulted buffer therefore went into do_user_addr_fault()
with interrupts off, and was only stopped by its legacy WARN_ON_ONCE()
on a clear IF flag. The helpers now disable page faults explicitly, so
the fault is refused up front and forwarded to the instruction as a #PF,
which is what was intended.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
anslcd_write() checks the user buffer with access_ok() and then reads it
one byte at a time with __get_user(), writing each byte to the LCD in
between. The ANSLCD_SENDCTRL ioctl does the same with the ioctl
argument, but with no access_ok() at all, so on architectures where
__get_user() does not check the address it will read from any address it
is given.
Use get_user() in both places. The ignored return values stay as they
were: a fault still reads as zero, which ends the SENDCTRL loop.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
write_block() reads the user buffer one byte at a time with __get_user()
while programming and then verifying the flash, relying on the
access_ok() done in flash_write(). Each __get_user() enables and
disables user access on its own anyway, so the separation saves nothing.
Use get_user().
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
execbuffer prefaults the relocation array and reads timeline fence
values one element at a time with __get_user(), after checking each
array with access_ok() up front. Each of those accesses enables and
disables user access on its own, so the up-front check saves nothing.
Both run with no object locks held: the prefault between dropping and
retaking the ww locks, the fence parsing before the ww context exists.
Use get_user(). The access_ok() checks stay, since they also decide how
a bad array fails.
The gem mman selftests use the unchecked variants on addresses they got
from their own mmaps, with no check at all. Convert those too.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The execbuffer relocation fast path writes each updated presumed_offset
back to the user's relocation array with __put_user(), ignoring any
failure. It does that while holding the objects' dma_resv locks, and
with page faults enabled unless the relocation cache happens to have an
atomic mapping active. So if that write faults, for example on a
copy-on-write page after a fork(), the fault handler takes mmap_lock
under dma_resv. That is the opposite of the order the i915 fault
handler uses, which takes the object lock under mmap_lock.
The comment above it claimed this could not happen, because "we did
previously check if the relocations were writable (access_ok)".
access_ok() is purely a range check. The comment dates from when this
was access_ok(VERIFY_WRITE), and that only ever made a difference on the
original i386, whose write-protect bit did not stop supervisor writes.
So nothing has made sure the array was writable for decades.
Do the write with page faults disabled, and if it fails, fall back to
the slow path exactly as we already do when reading the relocations
fails part-way through. We cannot just ignore the failure: the object
has already been relocated, and a stale presumed_offset could later
match again and skip a relocation that is needed. The slow path
prefaults and retries. If the write still fails, it copies the
relocations and marks every presumed_offset invalid with faults allowed
and no locks held, which breaks copy-on-write as needed.
One user-visible change: a relocation array in genuinely read-only
memory used to get through the fast path, silently losing the
presumed_offset updates. It now gets -EFAULT from the slow path, as it
already did whenever anything else sent execbuffer there. The uapi has
the kernel updating presumed_offset, so the array is expected to be
writable.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
gntdev_copy() updates per-segment status words with __get_user() and
__put_user(). privcmd writes back mmap batch errors and the resource
frame count with __put_user(). The pointers were validated earlier,
away from the accesses: by a copy_from_user() of the enclosing
structure, or by an access_ok() on the whole array before a callback
walks it. Each access enables and disables user access on its own
anyway, so the separation saves nothing.
Use get_user() and put_user().
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
getu16_iotlb() and putu16_iotlb() use __get_user() and __put_user() when
the IOTLB maps to user virtual addresses. Nothing nearby checks the
translated address: that relies on the mapping having been validated
against the user's VMAs when it was set up.
Use get_user() and put_user(), which do the same single, untorn access
and also check the address. The only atomic-context use, the vdpa
simulators' notification check, now disables page faults around it, so
the might_fault() in the checked accessors stays quiet there.
This is part of getting rid of __get_user() and __put_user() entirely.
Tested-and-acked-by: Michael S. Tsirkin <mst@redhat.com>
Fixes: 42823a871fd4 ("vringh: support VA with iotlb")
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
When vdpa_sim runs with use_va (the default), its rings live in user
memory, and vringh reads the ring's flags and event index with
__get_user() through the user address. The net and block simulators
call vringh_need_notify_iotlb() with bottom halves disabled, so those
reads happen in atomic context.
That only works today because __get_user() has no might_fault() check: a
fault is not handled in atomic context and simply comes back as -EFAULT.
Make that explicit with pagefault_disable() around the call, so vringh
can use the normal user accessors without complaint. Only the
notification check needs this: the rest of the ring processing runs in
the same kthread without bottom halves disabled, and can fault normally.
Tested-and-acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
ubi_get_ec_info() checks the user's erase_counters array with
access_ok() and then fills it one entry at a time with __put_user(),
taking the wear-leveling lock for each entry in between. Each of those
accesses enables and disables user access on its own, so the up-front
check saves nothing.
Use put_user(). The access_ok() stays, so a bad array still fails
before anything is written.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
isapnp_proc_bus_read() checks the user buffer with access_ok() and then
copies the configuration registers one byte at a time with __put_user(),
reading each register in between. Each of those accesses enables and
disables user access on its own, so the up-front check saves nothing.
Use put_user(). The ignored return value and the access_ok() stay as
they were.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
proc_bus_pci_read() and proc_bus_pci_write() check the user buffer with
access_ok() and then copy config space one byte, word or dword at a time
with __put_user() and __get_user(). Each of those accesses enables and
disables user access on its own, so the up-front check saves nothing.
Use put_user() and get_user(). This deliberately changes nothing else:
the return values were ignored before and still are, and the access_ok()
stays, since it is the only error these functions report for a bad
buffer.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
read_port() and write_port() check the whole user buffer with
access_ok() and then move it one byte at a time with __put_user() and
__get_user(), doing an inb() or outb() for each. Each of those accesses
enables and disables user access on its own, so the up-front check saves
nothing.
Use put_user() and get_user(). The access_ok() stays, because it also
makes a partly invalid buffer fail up front, rather than after some
ports have already been read or written.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The comment in set_aliased_prot() says the target address is faulted in
with __get_user(), but the code has used copy_from_kernel_nofault() for
a long time. Make the comment say so.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The FPU signal frame code reads and writes a handful of individual
fields (the xstate magic words, the legacy status word, the xfeatures
header and PKRU) with __get_user() and __put_user(). These rely on an
access_ok() of the whole frame done earlier by the caller. Each of
those accesses enables and disables user access on its own, so the
up-front check saves nothing. On x86, __get_user() is even more
expensive than get_user(): it does an lfence, where get_user() checks
the address with a couple of plain instructions.
Use get_user() and put_user(). The accesses that run with page faults
disabled stay that way; get_user() and put_user() are fine there.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
genregs_set() and genregs32_set() read the user buffer one word at a
time with __get_user(), calling putreg() for each. The access_ok() that
makes this safe is in the generic copy_regset_from_user(), on the other
side of an indirect call through the regset. Each of those accesses
enables and disables user access on its own, so the up-front check saves
nothing. On x86, __get_user() is even more expensive than get_user():
it does an lfence, where get_user() checks the address with a couple of
plain instructions.
Use get_user(), so each read checks its own address.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The user callchain walkers read each two-word stack frame with
__get_user(), after checking the frame with valid_user_frame(), which is
just __access_ok(). They run with page faults disabled, since they can
be called from NMI context.
Read each frame inside a scoped_user_read_access() instead, which does
the range check itself and needs only a single stac/clac pair for both
loads. That leaves valid_user_frame() unused, so remove it.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
copy_stack_frame() reads the two words of a user stack frame with
__get_user(), after an __access_ok() on the frame and inside
pagefault_disable(), since the user stack walk can run in atomic
context.
Do the two reads in a scoped_user_read_access() instead. It nests
inside the pagefault_disable() section, does the range check itself, and
needs only a single stac/clac pair for both loads.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
All four sigreturn variants (32-bit sigreturn and rt_sigreturn, native
64-bit and x32 rt_sigreturn) do an access_ok() on the whole signal frame
only to read the signal mask with __get_user(). The 64-bit and x32
variants also read uc_flags that way. Everything else in the frame is
read by helpers that do their own checking.
Read those fields inside a scoped_user_read_access() instead, which does
the range check once and puts a single stac/clac pair around plain
loads. The scoped accessor shadows 'frame' with a checked copy only
inside its block, so the badframe path still reports the original
pointer.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
__do_fast_syscall_32() fetches the user's EBP from the stack slot the
vDSO stashed it in. On 64-bit kernels it used __get_user(), as a
micro-optimization: the address is explicitly 32 bits, so it cannot be
out of range.
That optimization has turned into a pessimization. On x86-64,
get_user() checks the address with a compare and a conditional move,
while __get_user() does an lfence instead. Use get_user() on both
32-bit and 64-bit, which also removes the IS_ENABLED(CONFIG_X86_64)
special case.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
____sys_recvmsg() writes msg_flags and msg_controllen back with
__put_user(), and the compat sendmmsg()/recvmmsg() loops write msg_len
the same way. None of these has an access_ok() of its own: they rely on
the earlier copy_from_user() of the message header having checked the
range. For the compat msg_len that is not even true, since msg_len
lives after the compat_msghdr that was copied. It is only safe because
compat pointers are 32-bit. The native mmsg paths already use
put_user().
Use put_user() everywhere. On x86 that adds a couple of instructions to
check the address, on a path that has to enable and disable user access
for each write anyway.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
copy_user_syms() and bpf_uprobe_multi_link_attach() check whole user
arrays with access_ok() up front, then read them one element at a time
with __get_user(), with other work in between: allocations and
strncpy_from_user() in copy_user_syms(), validation in the uprobe_multi
loop. Each of those accesses enables and disables user access on its
own, so the up-front check saves nothing. On x86, __get_user() is even
more expensive than get_user(): it does an lfence, where get_user()
checks the address with a couple of plain instructions.
Use get_user(). The access_ok() checks stay, because they also make a
bad array fail with -EFAULT before anything else is looked up or
allocated. Update the comment that said they were there for
__get_user().
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
syscall_user_dispatch() reads the selector byte with __get_user(),
relying on an access_ok() done once at prctl time when the selector
address was set. So the pointer being dereferenced was validated in a
different system call, and the separation saves nothing anyway:
__get_user() still enables and disables user access, and on x86 it does
an lfence that get_user() avoids.
Use get_user(), and drop the comment explaining why the unchecked access
was safe.
The selector may be a tagged address. The prctl-time check is done on
untagged_addr(selector), but it is the tagged pointer that gets stored,
and __get_user() never checked it. get_user() does, and on x86 with LAM
a tagged pointer fails its range check. So untag it at the point of use
as well. The prctl-time check stays, so a bad address is still reported
when it is set.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
is_trap_at_addr() reads the instruction at a user address with
__get_user(), inside pagefault_disable() since the caller holds
mmap_lock. There is no access_ok() in front of it, and nothing here
needs the unchecked version: with page faults disabled, get_user()'s
might_fault() check returns early, so that is no reason to avoid it
either.
Use get_user(), which also checks that the address is a user address,
and on x86 avoids the lfence that __get_user() does.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
PTRACE_GETREGSET and PTRACE_SETREGSET do an access_ok() on the user
iovec, read its two fields with __get_user(), and once the regset has
been transferred write the length back with __put_user(). Each of those
accesses enables and disables user access on its own, so the up-front
check saves nothing. On x86, __get_user() is even more expensive than
get_user(): it does an lfence, where get_user() checks the address with
a couple of plain instructions.
Just use get_user() and put_user(), and drop the access_ok(). Both
fields are read before anything else is done, so a bad pointer still
fails with -EFAULT up front.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
get_compat_sigevent() does one access_ok() on the user structure and
then reads four fields with __get_user(). Each of those reads enables
and disables user access on its own, so the single range check no longer
buys anything.
Read the fields inside a scoped_user_read_access() instead.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
__save_altstack() and __compat_save_altstack() write three fields with
__put_user(), relying on the caller having done access_ok() on the whole
signal frame. Each of those writes enables and disables user access on
its own, so that check saves nothing.
x86 and powerpc already avoid these functions by using
unsafe_save_altstack() inside their own user access regions. Use the
same helpers here, inside a scoped_user_write_access(), so that every
other architecture gets a single range check and a single user access
region too. None of those callers is itself inside a user access
region, so nothing nests.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
The old sigaction() system call and its compat counterpart do one
access_ok() on the user structure and then a series of __get_user() or
__put_user() calls on its fields. That was an optimization back when
each of those was a single memory access. These days each of them
enables and disables user access on its own (stac/clac on x86), so the
up-front check saves nothing.
Convert them to scoped_user_{read,write}_access() with
unsafe_{get,put}_user(), which does the range check once and puts a
single stac/clac pair around plain moves.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"All fixes in drivers (or the tape ULD) and one core fix to bsg (the
block ioctl equivalent of sg_io).
The biggest is the race in auth updates fix in iscsi configfs, but the
next biggest one is in bsg but the generic pieces of that are mostly
threading reply_len"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
scsi: libsas: Fix SMP IO deadlock during HA resume
scsi: libiscsi: Validate the task named by a management response
scsi: libiscsi: Validate the ITT reflected in a Reject PDU
scsi: libiscsi: Reject a negative task index from parse_pdu_itt
scsi: target: iscsi: Fix race in discovery auth updates
scsi: target: Disable interrupts while holding delayed_cmd_lock
scsi: st: Fix use-after-free race between st_remove() and st_open()
scsi: st: Save the visited block for the partition the drive is in
scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A small collection of driver specific fixes, all quite important if
you have the relevant hardware"
* tag 'spi-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: spi-fsl-lpspi: directly return |
