All of lore.kernel.org
 help / color / mirror / Atom feed
From: Eric Lin <tesheng@andestech.com>
To: Pekka Enberg <penberg@gmail.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>,
	"dslin1010@gmail.com" <dslin1010@gmail.com>,
	"Alan Quey-Liang Kao\(?????????\)" <alankao@andestech.com>,
	LKML <linux-kernel@vger.kernel.org>, Peter Xu <peterx@redhat.com>,
	Daniel Jordan <daniel.m.jordan@oracle.com>,
	Palmer Dabbelt <palmer@dabbelt.com>,
	Paul Walmsley <paul.walmsley@sifive.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Michel Lespinasse <walken@google.com>,
	linux-riscv <linux-riscv@lists.infradead.org>
Subject: Re: [PATCH] riscv/mm: Prevent kernel module access user-space memory without uaccess routines
Date: Tue, 1 Dec 2020 13:32:57 +0800	[thread overview]
Message-ID: <20201201053257.GB7647@atcfdc88> (raw)
In-Reply-To: <CAOJsxLH-tCyvydX_+djXNMpOAxW2Zr7rAZizLUwQVNyU8YreBg@mail.gmail.com>

On Mon, Nov 30, 2020 at 04:07:03PM +0800, Pekka Enberg wrote:

Hi Pekka,
> On Mon, Nov 30, 2020 at 7:33 AM Eric Lin <tesheng@andestech.com> wrote:
> >
> > In the page fault handler, an access to user-space memory
> > without get/put_user() or copy_from/to_user() routines is
> > not resolved properly. Like arm and other architectures,
> > we need to let it die earlier in page fault handler.
> 
> Fix looks good to me. Can you elaborate on how you found the issue and
> how the bug manifests itself?

OK, I'll elaborate more on the commit message.

> 
> >
> > Signed-off-by: Eric Lin <tesheng@andestech.com>
> > Cc: Alan Kao <alankao@andestech.com>
> > ---
> >  arch/riscv/mm/fault.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
> > index 3c8b9e433c67..a452cfa266a2 100644
> > --- a/arch/riscv/mm/fault.c
> > +++ b/arch/riscv/mm/fault.c
> > @@ -232,6 +232,9 @@ asmlinkage void do_page_fault(struct pt_regs *regs)
> >         if (user_mode(regs))
> >                 flags |= FAULT_FLAG_USER;
> >
> > +       if (!user_mode(regs) && addr < TASK_SIZE && unlikely(!(regs->status & SR_SUM)))
> > +               die(regs, "Accessing user space memory without uaccess routines\n");
> 
> Let's introduce a die_kernel_fault() helper (similar to arm64, for
> example) to ensure same semantics for the different kernel faults. You
> can extract the helper from no_context().

OK, I'll add a die_kernel_fault() helper function in v2.

Thanks for your review.

> 
> > +
> >         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
> >
> >         if (cause == EXC_STORE_PAGE_FAULT)
> > --
> > 2.17.0
> >
> >
> > _______________________________________________
> > linux-riscv mailing list
> > linux-riscv@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/linux-riscv

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

WARNING: multiple messages have this Message-ID (diff)
From: Eric Lin <tesheng@andestech.com>
To: Pekka Enberg <penberg@gmail.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
	linux-riscv <linux-riscv@lists.infradead.org>,
	Michel Lespinasse <walken@google.com>,
	Daniel Jordan <daniel.m.jordan@oracle.com>,
	Peter Xu <peterx@redhat.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Albert Ou <aou@eecs.berkeley.edu>,
	Palmer Dabbelt <palmer@dabbelt.com>,
	Paul Walmsley <paul.walmsley@sifive.com>,
	"dslin1010@gmail.com" <dslin1010@gmail.com>,
	"Alan Quey-Liang Kao(?????????)" <alankao@andestech.com>
Subject: Re: [PATCH] riscv/mm: Prevent kernel module access user-space memory without uaccess routines
Date: Tue, 1 Dec 2020 13:32:57 +0800	[thread overview]
Message-ID: <20201201053257.GB7647@atcfdc88> (raw)
In-Reply-To: <CAOJsxLH-tCyvydX_+djXNMpOAxW2Zr7rAZizLUwQVNyU8YreBg@mail.gmail.com>

On Mon, Nov 30, 2020 at 04:07:03PM +0800, Pekka Enberg wrote:

Hi Pekka,
> On Mon, Nov 30, 2020 at 7:33 AM Eric Lin <tesheng@andestech.com> wrote:
> >
> > In the page fault handler, an access to user-space memory
> > without get/put_user() or copy_from/to_user() routines is
> > not resolved properly. Like arm and other architectures,
> > we need to let it die earlier in page fault handler.
> 
> Fix looks good to me. Can you elaborate on how you found the issue and
> how the bug manifests itself?

OK, I'll elaborate more on the commit message.

> 
> >
> > Signed-off-by: Eric Lin <tesheng@andestech.com>
> > Cc: Alan Kao <alankao@andestech.com>
> > ---
> >  arch/riscv/mm/fault.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
> > index 3c8b9e433c67..a452cfa266a2 100644
> > --- a/arch/riscv/mm/fault.c
> > +++ b/arch/riscv/mm/fault.c
> > @@ -232,6 +232,9 @@ asmlinkage void do_page_fault(struct pt_regs *regs)
> >         if (user_mode(regs))
> >                 flags |= FAULT_FLAG_USER;
> >
> > +       if (!user_mode(regs) && addr < TASK_SIZE && unlikely(!(regs->status & SR_SUM)))
> > +               die(regs, "Accessing user space memory without uaccess routines\n");
> 
> Let's introduce a die_kernel_fault() helper (similar to arm64, for
> example) to ensure same semantics for the different kernel faults. You
> can extract the helper from no_context().

OK, I'll add a die_kernel_fault() helper function in v2.

Thanks for your review.

> 
> > +
> >         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
> >
> >         if (cause == EXC_STORE_PAGE_FAULT)
> > --
> > 2.17.0
> >
> >
> > _______________________________________________
> > linux-riscv mailing list
> > linux-riscv@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/linux-riscv

  reply	other threads:[~2020-12-01  5:34 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-11-30  5:30 [PATCH] riscv/mm: Prevent kernel module access user-space memory without uaccess routines Eric Lin
2020-11-30  5:30 ` Eric Lin
2020-11-30  8:07 ` Pekka Enberg
2020-11-30  8:07   ` Pekka Enberg
2020-12-01  5:32   ` Eric Lin [this message]
2020-12-01  5:32     ` Eric Lin
2020-11-30  8:30 ` Christoph Hellwig
2020-11-30  8:30   ` Christoph Hellwig
2020-12-01  5:20   ` Eric Lin
2020-12-01  5:20     ` Eric Lin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201201053257.GB7647@atcfdc88 \
    --to=tesheng@andestech.com \
    --cc=akpm@linux-foundation.org \
    --cc=alankao@andestech.com \
    --cc=aou@eecs.berkeley.edu \
    --cc=daniel.m.jordan@oracle.com \
    --cc=dslin1010@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=palmer@dabbelt.com \
    --cc=paul.walmsley@sifive.com \
    --cc=penberg@gmail.com \
    --cc=peterx@redhat.com \
    --cc=walken@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.