From mboxrd@z Thu Jan 1 00:00:00 1970 From: catalin.marinas@arm.com (Catalin Marinas) Date: Tue, 16 Feb 2016 23:04:12 +0000 Subject: [PATCH v2] arm64: add alignment fault hanling In-Reply-To: <56C39538.6090009@linux.intel.com> References: <329817481.954581455597874663.JavaMail.weblogic@epmlwas08c> <20160216103104.GC14509@arm.com> <56C300AD.8070505@arm.com> <20160216122153.GD19413@e104818-lin.cambridge.arm.com> <20160216160055.GH14509@arm.com> <20160216170408.GL14509@arm.com> <56C39538.6090009@linux.intel.com> Message-ID: <20160216230409.GA24379@MBP.local> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Tue, Feb 16, 2016 at 01:31:36PM -0800, Arjan van de Ven wrote: > On 2/16/2016 10:50 AM, Linus Torvalds wrote: > >On Tue, Feb 16, 2016 at 9:04 AM, Will Deacon wrote: > >>[replying to self and adding some x86 people] > >> > >>Background: Euntaik reports a problem where userspace has ended up with > >>a memory page mapped adjacent to an MMIO page (e.g. from /dev/mem or a > >>PCI memory bar from someplace in /sys). strncpy_from_user happens with > >>the word-at-a-time implementation, and we end up reading into the MMIO > >>page. > > how does this work if the adjacent page is not accessible? do_strncpy_from_user() assumes by default that it can read a word at a time using get_user() but checks its return value in case it failed and falls back to byte at a time. What happens on arm64 is that for alignment faults we don't have a handler that would search the exception table and run the get_user() fixup. > isn't the general rule for such basic functions "don't touch memory > unless you KNOW it is there" Well, user access routines are in general safe with this via the exception handling + fixup mechanism (which usually returns -EFAULT). That's what do_strncpy_from_user() tries to do by optimising away the boundary checks. -- Catalin From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756414AbcBPXEQ (ORCPT ); Tue, 16 Feb 2016 18:04:16 -0500 Received: from foss.arm.com ([217.140.101.70]:57224 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756383AbcBPXEP (ORCPT ); Tue, 16 Feb 2016 18:04:15 -0500 Date: Tue, 16 Feb 2016 23:04:12 +0000 From: Catalin Marinas To: Arjan van de Ven Cc: Linus Torvalds , Will Deacon , "vladimir.murzin@arm.com" , "suzuki.poulose@arm.com" , Peter Zijlstra , "linux-kernel@vger.kernel.org" , "salyzyn@android.com" , "riandrews@android.com" , "james.morse@arm.com" , EunTaik Lee , Peter Anvin , Robin Murphy , "Dave.Martin@arm.com" , "linux-arm-kernel@lists.infradead.org" Subject: Re: [PATCH v2] arm64: add alignment fault hanling Message-ID: <20160216230409.GA24379@MBP.local> References: <329817481.954581455597874663.JavaMail.weblogic@epmlwas08c> <20160216103104.GC14509@arm.com> <56C300AD.8070505@arm.com> <20160216122153.GD19413@e104818-lin.cambridge.arm.com> <20160216160055.GH14509@arm.com> <20160216170408.GL14509@arm.com> <56C39538.6090009@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <56C39538.6090009@linux.intel.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Feb 16, 2016 at 01:31:36PM -0800, Arjan van de Ven wrote: > On 2/16/2016 10:50 AM, Linus Torvalds wrote: > >On Tue, Feb 16, 2016 at 9:04 AM, Will Deacon wrote: > >>[replying to self and adding some x86 people] > >> > >>Background: Euntaik reports a problem where userspace has ended up with > >>a memory page mapped adjacent to an MMIO page (e.g. from /dev/mem or a > >>PCI memory bar from someplace in /sys). strncpy_from_user happens with > >>the word-at-a-time implementation, and we end up reading into the MMIO > >>page. > > how does this work if the adjacent page is not accessible? do_strncpy_from_user() assumes by default that it can read a word at a time using get_user() but checks its return value in case it failed and falls back to byte at a time. What happens on arm64 is that for alignment faults we don't have a handler that would search the exception table and run the get_user() fixup. > isn't the general rule for such basic functions "don't touch memory > unless you KNOW it is there" Well, user access routines are in general safe with this via the exception handling + fixup mechanism (which usually returns -EFAULT). That's what do_strncpy_from_user() tries to do by optimising away the boundary checks. -- Catalin