From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16990C33CB3 for ; Sat, 1 Feb 2020 17:56:47 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id B06702067C for ; Sat, 1 Feb 2020 17:56:46 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="UbIWczwi" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B06702067C Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 0D4E46B0616; Sat, 1 Feb 2020 12:56:46 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 0AD756B0617; Sat, 1 Feb 2020 12:56:46 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F045D6B0618; Sat, 1 Feb 2020 12:56:45 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0222.hostedemail.com [216.40.44.222]) by kanga.kvack.org (Postfix) with ESMTP id DCB0B6B0616 for ; Sat, 1 Feb 2020 12:56:45 -0500 (EST) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 9F14A181AEF1E for ; Sat, 1 Feb 2020 17:56:45 +0000 (UTC) X-FDA: 76442313570.10.stem30_7528ead898941 X-HE-Tag: stem30_7528ead898941 X-Filterd-Recvd-Size: 5535 Received: from mail-pj1-f65.google.com (mail-pj1-f65.google.com [209.85.216.65]) by imf24.hostedemail.com (Postfix) with ESMTP for ; Sat, 1 Feb 2020 17:56:44 +0000 (UTC) Received: by mail-pj1-f65.google.com with SMTP id r67so4402029pjb.0 for ; Sat, 01 Feb 2020 09:56:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=1rxiDiiWyy+RaaD0YllXb5sVbRbHdZvAaLoyASC1RHA=; b=UbIWczwiQvzV+o1/R62NbaP1lFCIW4J4I1Znu2jtuEVKVBfSBP0kAK6LdTGJ1ujZps /G0uyRiL+3/xM2Hvkwz1ZQhXsnR97q5ZnjDFj6XXbM/7HbkX4QGvl8Ij1VWRDdoVEVqI D9Ks/1wEw6tLdPvSdLg1Vw6B3NocqQ1gDZwAk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=1rxiDiiWyy+RaaD0YllXb5sVbRbHdZvAaLoyASC1RHA=; b=t0xtAN4Gck4KN+ATexb3vRUTbSxKpV+ZkNA2v9O4Tcx1cj2WYSHdvI43VQifV3GLdL m7qQuTBlF3rTQHan4u+5N2s/V4uHh16Fmp+/wdhJMJvi0bhrMIw0tmtfwXmwgmm/xG3w eTM1hh/LjTz/OppM2z6taSeKyIfORPA2ArEgRa38rfG8vCam/02JXF5wMGFAKdQKHDE6 lAV0fxltV6X5ECgMQt+TxUMdNwLGWj9Tvv89WsI6JfvRDAyd8vS5TBKGMwTCw2M6vOMo 2mkxr/tpScEeCoNGwU5L97HFKh6N4poxTyDvSv+bPYNoWwlTgWWOyHitquTzM49kHV7A DB0Q== X-Gm-Message-State: APjAAAUeO9AEPkIw2ruLIwt1I8c6izWOkLppTRgq+9TqKPnetvEjTWEX pCsPxibK/wOnB14bJB0SljAAqw== X-Google-Smtp-Source: APXvYqxT3vOizdt1K5+VTatra4+LXkGQ2fpy4tPPX6L9duoaO3re51J2wolPrp+nN4BPCFA89zymvQ== X-Received: by 2002:a17:902:9b93:: with SMTP id y19mr15780032plp.89.1580579803746; Sat, 01 Feb 2020 09:56:43 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id gc1sm14073972pjb.20.2020.02.01.09.56.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 01 Feb 2020 09:56:42 -0800 (PST) Date: Sat, 1 Feb 2020 09:56:41 -0800 From: Kees Cook To: Jann Horn Cc: Christian Borntraeger , Christoph Hellwig , Christopher Lameter , Jiri Slaby , Julian Wiedmann , Ursula Braun , Alexander Viro , kernel list , David Windsor , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Linux-MM , linux-xfs@vger.kernel.org, Linus Torvalds , Andy Lutomirski , "David S. Miller" , Laura Abbott , Mark Rutland , "Martin K. Petersen" , Paolo Bonzini , Christoffer Dall , Dave Kleikamp , Jan Kara , Luis de Bethencourt , Marc Zyngier , Rik van Riel , Matthew Garrett , linux-fsdevel , linux-arch , Network Development , Kernel Hardening , Vlastimil Babka , Michal Kubecek Subject: Re: [kernel-hardening] [PATCH 09/38] usercopy: Mark kmalloc caches as usercopy caches Message-ID: <202002010952.ACDA7A81@keescook> References: <202001271519.AA6ADEACF0@keescook> <5861936c-1fe1-4c44-d012-26efa0c8b6e7@de.ibm.com> <202001281457.FA11CC313A@keescook> <6844ea47-8e0e-4fb7-d86f-68046995a749@de.ibm.com> <20200129170939.GA4277@infradead.org> <771c5511-c5ab-3dd1-d938-5dbc40396daa@de.ibm.com> <202001300945.7D465B5F5@keescook> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Jan 31, 2020 at 01:03:40PM +0100, Jann Horn wrote: > I think dma-kmalloc slabs should be handled the same way as normal > kmalloc slabs. When a dma-kmalloc allocation is freshly created, it is > just normal kernel memory - even if it might later be used for DMA -, > and it should be perfectly fine to copy_from_user() into such > allocations at that point, and to copy_to_user() out of them at the > end. If you look at the places where such allocations are created, you > can see things like kmemdup(), memcpy() and so on - all normal > operations that shouldn't conceptually be different from usercopy in > any relevant way. I can't find where the address limit for dma-kmalloc is implemented. As to whitelisting all of dma-kmalloc -- I guess I can be talked into it. It still seems like the memory used for direct hardware communication shouldn't be exposed to userspace, but it we're dealing with packet data, etc, then it makes sense not to have to have bounce buffers, etc. -- Kees Cook