Re: [PATCH v2 10/18] m68k: fix access_ok for coldfire

Geert Uytterhoeven
2022-02-18T09:00:39Z

Hi Arnd,

On Wed, Feb 16, 2022 at 2:17 PM Arnd Bergmann <arnd@kernel.org> wrote:
> From: Arnd Bergmann <arnd@arndb.de>
>
> While most m68k platforms use separate address spaces for user
> and kernel space, at least coldfire does not, and the other
> ones have a TASK_SIZE that is less than the entire 4GB address
> range.
>
> Using the default implementation of __access_ok() stops coldfire
> user space from trivially accessing kernel memory.
>
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Thanks for your patch!

> --- a/arch/m68k/include/asm/uaccess.h
> +++ b/arch/m68k/include/asm/uaccess.h
> @@ -12,14 +12,21 @@
> #include <asm/extable.h>
>
> /* We let the MMU do all checking */
> -static inline int access_ok(const void __user *addr,
> +static inline int access_ok(const void __user *ptr,
> unsigned long size)
> {
> + unsigned long limit = TASK_SIZE;
> + unsigned long addr = (unsigned long)ptr;
> +
> /*
> * XXX: for !CONFIG_CPU_HAS_ADDRESS_SPACES this really needs to check
> * for TASK_SIZE!
> + * Removing this helper is probably sufficient.
> */

Shouldn't the above comment block be removed completely,
as this is now implemented below?

> - return 1;
> + if (IS_ENABLED(CONFIG_CPU_HAS_ADDRESS_SPACES))
> + return 1;
> +
> + return (size <= limit) && (addr <= (limit - size));
> }

Any pesky compilers that warn (or worse with -Werror) about
"condition always true" for TASK_SIZE = 0xFFFFFFFFUL?

Gr{oetje,eeting}s,

Geert