From mboxrd@z Thu Jan 1 00:00:00 1970 From: Al Viro Subject: Re: [PATCH v12 01/12] lib: introduce copy_struct_{to,from}_user helpers Date: Fri, 6 Sep 2019 00:49:44 +0100 Message-ID: <20190905234944.GT1131@ZenIV.linux.org.uk> References: <20190904201933.10736-1-cyphar@cyphar.com> <20190904201933.10736-2-cyphar@cyphar.com> <20190905180750.GQ1131@ZenIV.linux.org.uk> <20190905230003.bek7vqdvruzi4ybx@yavin.dot.cyphar.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20190905230003.bek7vqdvruzi4ybx@yavin.dot.cyphar.com> Sender: linux-kernel-owner@vger.kernel.org To: Aleksa Sarai Cc: Jeff Layton , "J. Bruce Fields" , Arnd Bergmann , David Howells , Shuah Khan , Shuah Khan , Ingo Molnar , Peter Zijlstra , Christian Brauner , Rasmus Villemoes , Eric Biederman , Andy Lutomirski , Andrew Morton , Alexei Starovoitov , Kees Cook , Jann Horn , Tycho Andersen , David Drysdale , Chanho Min , Oleg Nesterov , Alexander List-Id: linux-arch.vger.kernel.org On Fri, Sep 06, 2019 at 09:00:03AM +1000, Aleksa Sarai wrote: > > > + return -EFAULT; > > > + } > > > + /* Copy the interoperable parts of the struct. */ > > > + if (__copy_to_user(dst, src, size)) > > > + return -EFAULT; > > > > Why not simply clear_user() and copy_to_user()? > > I'm not sure I understand what you mean -- are you asking why we need to > do memchr_inv(src + size, 0, rest) earlier? I'm asking why bother with __ and separate access_ok(). > > if ((unsigned long)addr & 1) { > > u8 v; > > if (get_user(v, (__u8 __user *)addr)) > > return -EFAULT; > > if (v) > > return -E2BIG; > > addr++; > > } > > if ((unsigned long)addr & 2) { > > u16 v; > > if (get_user(v, (__u16 __user *)addr)) > > return -EFAULT; > > if (v) > > return -E2BIG; > > addr +=2; > > } > > if ((unsigned long)addr & 4) { > > u32 v; > > if (get_user(v, (__u32 __user *)addr)) > > return -EFAULT; > > if (v) > > return -E2BIG; > > } > > Actually, this is a dumb way to do it - page size on anything is going to be a multiple of 8, so you could just as well read 8 bytes from an address aligned down. Then mask the bytes you don't want to check out and see if there's anything left. You can have readability boundaries inside a page - it's either the entire page (let alone a single word) being readable, or it's EFAULT for all parts. > > would be saner, and things like x86 could trivially add an > > asm variant - it's not hard. Incidentally, memchr_inv() is > > an overkill in this case... > > Why is memchr_inv() overkill? Look at its implementation; you only care if there are non-zeroes, you don't give a damn where in the buffer the first one would be. All you need is the same logics as in "from userland" case if (!count) return true; offset = (unsigned long)from & 7 p = (u64 *)(from - offset); v = *p++; if (offset) { // unaligned count += offset; v &= ~aligned_byte_mask(offset); // see strnlen_user.c } while (count > 8) { if (v) return false; v = *p++; count -= 8; } if (count != 8) v &= aligned_byte_mask(count); return v == 0; All there is to it... From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from zeniv.linux.org.uk ([195.92.253.2]:44158 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389851AbfIEXwJ (ORCPT ); Thu, 5 Sep 2019 19:52:09 -0400 Date: Fri, 6 Sep 2019 00:49:44 +0100 From: Al Viro Subject: Re: [PATCH v12 01/12] lib: introduce copy_struct_{to,from}_user helpers Message-ID: <20190905234944.GT1131@ZenIV.linux.org.uk> References: <20190904201933.10736-1-cyphar@cyphar.com> <20190904201933.10736-2-cyphar@cyphar.com> <20190905180750.GQ1131@ZenIV.linux.org.uk> <20190905230003.bek7vqdvruzi4ybx@yavin.dot.cyphar.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190905230003.bek7vqdvruzi4ybx@yavin.dot.cyphar.com> Sender: linux-arch-owner@vger.kernel.org List-ID: To: Aleksa Sarai Cc: Jeff Layton , "J. Bruce Fields" , Arnd Bergmann , David Howells , Shuah Khan , Shuah Khan , Ingo Molnar , Peter Zijlstra , Christian Brauner , Rasmus Villemoes , Eric Biederman , Andy Lutomirski , Andrew Morton , Alexei Starovoitov , Kees Cook , Jann Horn , Tycho Andersen , David Drysdale , Chanho Min , Oleg Nesterov , Alexander Shishkin , Jiri Olsa , Namhyung Kim , Aleksa Sarai , Linus Torvalds , containers@lists.linux-foundation.org, linux-alpha@vger.kernel.org, linux-api@vger.kernel.org, linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-ia64@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-m68k@lists.linux-m68k.org, linux-mips@vger.kernel.org, linux-parisc@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-s390@vger.kernel.org, linux-sh@vger.kernel.org, linux-xtensa@linux-xtensa.org, sparclinux@vger.kernel.org Message-ID: <20190905234944.cncelJ6k_YDuoya2R6kK9v1NfxiCMXC_U0owFL-hGvM@z> On Fri, Sep 06, 2019 at 09:00:03AM +1000, Aleksa Sarai wrote: > > > + return -EFAULT; > > > + } > > > + /* Copy the interoperable parts of the struct. */ > > > + if (__copy_to_user(dst, src, size)) > > > + return -EFAULT; > > > > Why not simply clear_user() and copy_to_user()? > > I'm not sure I understand what you mean -- are you asking why we need to > do memchr_inv(src + size, 0, rest) earlier? I'm asking why bother with __ and separate access_ok(). > > if ((unsigned long)addr & 1) { > > u8 v; > > if (get_user(v, (__u8 __user *)addr)) > > return -EFAULT; > > if (v) > > return -E2BIG; > > addr++; > > } > > if ((unsigned long)addr & 2) { > > u16 v; > > if (get_user(v, (__u16 __user *)addr)) > > return -EFAULT; > > if (v) > > return -E2BIG; > > addr +=2; > > } > > if ((unsigned long)addr & 4) { > > u32 v; > > if (get_user(v, (__u32 __user *)addr)) > > return -EFAULT; > > if (v) > > return -E2BIG; > > } > > Actually, this is a dumb way to do it - page size on anything is going to be a multiple of 8, so you could just as well read 8 bytes from an address aligned down. Then mask the bytes you don't want to check out and see if there's anything left. You can have readability boundaries inside a page - it's either the entire page (let alone a single word) being readable, or it's EFAULT for all parts. > > would be saner, and things like x86 could trivially add an > > asm variant - it's not hard. Incidentally, memchr_inv() is > > an overkill in this case... > > Why is memchr_inv() overkill? Look at its implementation; you only care if there are non-zeroes, you don't give a damn where in the buffer the first one would be. All you need is the same logics as in "from userland" case if (!count) return true; offset = (unsigned long)from & 7 p = (u64 *)(from - offset); v = *p++; if (offset) { // unaligned count += offset; v &= ~aligned_byte_mask(offset); // see strnlen_user.c } while (count > 8) { if (v) return false; v = *p++; count -= 8; } if (count != 8) v &= aligned_byte_mask(count); return v == 0; All there is to it...