Re: [PATCH 2/2] mm: make copy_to_kernel_nofault() not fault on user addresses

Christophe Leroy
2024-09-04T07:52:20Z

Hi,

Le 02/09/2024 à 07:31, Omar Sandoval a écrit :
> [Vous ne recevez pas souvent de courriers de osandov@osandov.com. Découvrez pourquoi ceci est important à https://aka.ms/LearnAboutSenderIdentification ]
>
> From: Omar Sandoval <osandov@fb.com>
>
> I found that on x86, copy_to_kernel_nofault() still faults on addresses
> outside of the kernel address range (including NULL):
>
> # echo ttyS0 > /sys/module/kgdboc/parameters/kgdboc
> # echo g > /proc/sysrq-trigger
> ...
> [15]kdb> mm 0 1234
> [ 94.652476] BUG: kernel NULL pointer dereference, address: 0000000000000000
...
>
> Note that copy_to_kernel_nofault() uses pagefault_disable(), but it
> still faults. This is because with Supervisor Mode Access Prevention
> (SMAP) enabled, do_user_addr_fault() Oopses on a fault for a user
> address from kernel space _before_ checking faulthandler_disabled().
>
> copy_from_kernel_nofault() avoids this by checking that the address is
> in the kernel before doing the actual memory access. Do the same in
> copy_to_kernel_nofault() so that we get an error as expected:
>
> # echo ttyS0 > /sys/module/kgdboc/parameters/kgdboc
> # echo g > /proc/sysrq-trigger
> ...
> [17]kdb> mm 0 1234
> kdb_putarea_size: Bad address 0x0
> diag: -21: Invalid address
>
> Signed-off-by: Omar Sandoval <osandov@fb.com>
> ---
> mm/maccess.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/mm/maccess.c b/mm/maccess.c
> index 72e9c03ea37f..d67dee51a1cc 100644
> --- a/mm/maccess.c
> +++ b/mm/maccess.c
> @@ -61,6 +61,9 @@ long copy_to_kernel_nofault(void *dst, const void *src, size_t size)
> if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
> align = (unsigned long)dst | (unsigned long)src;
>
> + if (!copy_kernel_nofault_allowed(dst, size))
> + return -ERANGE;
> +
> pagefault_disable();
> if (!(align & 7))
> copy_to_kernel_nofault_loop(dst, src, size, u64, Efault);
> --
> 2.46.0
>

This patch leads to the following errors on ppc64le_defconfig:

[ 2.423930][ T1] Running code patching self-tests ...
[ 2.428912][ T1] code-patching: test failed at line 395
[ 2.429085][ T1] code-patching: test failed at line 398
[ 2.429561][ T1] code-patching: test failed at line 432
[ 2.429679][ T1] code-patching: test failed at line 435

This seems to be linked to commit c28c15b6d28a ("powerpc/code-patching:
Use temporary mm for Radix MMU"), copy_from_kernel_nofault_allowed()
returns false for the patching area.

Christophe