From: Pavel Machek <pavel@ucw.cz>
To: Eric Dumazet <edumazet@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>,
mtk.manpages@gmail.com, Dmitry Vyukov <dvyukov@google.com>,
Alexander Potapenko <glider@google.com>,
Kostya Serebryany <kcc@google.com>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] [iov_iter] use memmove() when copying to/from user page
Date: Thu, 25 May 2017 23:27:15 +0200 [thread overview]
Message-ID: <20170525212715.GA23446@amd> (raw)
In-Reply-To: <CANn89i++6ZRNsuR3yfEg+crq4kYiY6H2MY7vk2Y7GN1NCs3ihw@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1886 bytes --]
On Thu 2017-05-25 10:15:11, Eric Dumazet wrote:
> On Thu, May 25, 2017 at 10:04 AM, Pavel Machek <pavel@ucw.cz> wrote:
> > Hi!
> >
> > On Tue 2017-05-16 23:48:54, Al Viro wrote:
> >> On Tue, May 16, 2017 at 03:15:16PM -0700, Dmitry Vyukov wrote:
> >> > > Because it's not going to be *one* call of memcpy() or memmove(). It's
> >> > > one per page.
> >> >
> >> >
> >> > I missed that.
> >> >
> >> > I assumed that in the case of sendfile from memfd to memfd data will
> >> > be copied directly. But it goes through a pipe with multiple buffers.
> >> > Does not look easily fixable.
> >>
> >> Which leaves us only with "will nasal demons really fly there?".
> >
> > It seems so:
> >
> > Date: Tue, 16 May 2017 14:27:34 +0200
> > From: Alexander Potapenko <glider@google.com>
> > Subject: [PATCH] [iov_iter] use memmove() when copying to/from user
> > page
> >
> > BUG: memcpy-param-overlap in generic_perform_write+0x551/0xa20
> > __msan_memcpy(ffff88013c6e3001, ffff88013c6e3000, 105)
> > CPU: 0 PID: 1040 Comm: probe Not tainted 4.11.0-rc5+ #2562
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
> > 01/01/2011
> >
> > At the very least, we do not want userland to trigger kernel
> > BUG()s... so this needs fixes beyond documentation.
>
> To be fair, this BUG() only happens because Alexander added one in memcpy() ,
> testing for the cases where memmove() should have been used.
>
> Kind of a debugging trap if you prefer.
>
> This is not something that a pristine kernel would do.
Aha, so BUG() is not realy a problem. Problem is that memcpy() may not
be called on overlapping regions, and may do something stupid; but we
don't have evidence that it does.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
next prev parent reply other threads:[~2017-05-25 21:27 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-16 12:27 [PATCH] [iov_iter] use memmove() when copying to/from user page Alexander Potapenko
2017-05-16 18:48 ` Al Viro
2017-05-16 18:53 ` Dmitry Vyukov
2017-05-16 19:37 ` Al Viro
2017-05-16 20:10 ` Dmitry Vyukov
2017-05-16 20:52 ` Al Viro
2017-05-16 21:01 ` Dmitry Vyukov
2017-05-16 21:33 ` Al Viro
2017-05-16 22:15 ` Dmitry Vyukov
2017-05-16 22:48 ` Al Viro
2017-05-25 17:04 ` Pavel Machek
2017-05-25 17:15 ` Eric Dumazet
2017-05-25 21:27 ` Pavel Machek [this message]
2017-05-25 18:22 ` Al Viro
2017-05-25 19:15 ` Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170525212715.GA23446@amd \
--to=pavel@ucw.cz \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=glider@google.com \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mtk.manpages@gmail.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.