Re: [RFC PATCH 06/10] uaccess: Refuse and warn on user copies when current->mm is NULL

[sashiko-bot@kernel.org]

> Accessing user memory from a task that has no mm is always a bug. This
> can happen from a kernel thread that is not using kthread_use_mm(), or
> from a task that has already gone through exit_mm() (e.g. when the last
> reference to a file is dropped from task_work at exit). KVM has had
> bugs of exactly this kind, and other drivers may have them too.
> 
> Such an access does not reliably fail. The user portion of the address
> space belongs to whatever mm happens to be lazily loaded, if any. If
> the access faults, the fault handler refuses to handle it and the copy
> fails, but if the page is already mapped, the copy silently reads or
> writes another task's memory.
> 
> Add uaccess_should_fail(), which combines the existing
> should_fail_usercopy() fault injection check with a
> WARN_ON_ONCE(!current->mm), and use it in place of every
> should_fail_usercopy() call. The user copy is then refused as if it had
> failed, so no access to user memory takes place.
> 
> This covers copy_{to,from}_user() on all architectures, including the
> masked user access paths that never call access_ok(), and the
> __copy_{to,from}_user() variants used by KVM's guest memory accessors.
> It also covers __copy_to_user_inatomic() (and so copy_to_user_nofault()),
> the user-backed iov_iter copy routines and strncpy_from_user().
> 
> Paths that never called should_fail_usercopy() are not covered, e.g.
> __copy_from_user_inatomic(), copy_from_user_nofault(), strnlen_user(),
> get_user()/put_user(), clear_user() and unsafe_*() accesses within
> user_access_begin() sections.
> 
> Signed-off-by: James Houghton <jthoughton@google.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261026215226.3713941-1-jthoughton@google.com?part=6