Re: [PATCH 0/3] x86/dumpstack: Inline copy_from_user_nmi()

Peter Zijlstra
2022-09-19T14:46:52Z

On Fri, Sep 16, 2022 at 12:57:23PM -0700, Andrew Morton wrote:
> On Fri, 16 Sep 2022 06:59:51 -0700 Kees Cook <keescook@chromium.org> wrote:
>
> > Hi,
> >
> > This fixes a find_vmap_area() deadlock. The main fix is patch 2, repeated here:
> >
> > The check_object_size() helper under CONFIG_HARDENED_USERCOPY is
> > designed to skip any checks where the length is known at compile time as
> > a reasonable heuristic to avoid "likely known-good" cases. However, it can
> > only do this when the copy_*_user() helpers are, themselves, inline too.
> >
> > Using find_vmap_area() requires taking a spinlock. The check_object_size()
> > helper can call find_vmap_area() when the destination is in vmap memory.
> > If show_regs() is called in interrupt context, it will attempt a call to
> > copy_from_user_nmi(), which may call check_object_size() and then
> > find_vmap_area(). If something in normal context happens to be in the
> > middle of calling find_vmap_area() (with the spinlock held), the interrupt
> > handler will hang forever.
> >
> > The copy_from_user_nmi() call is actually being called with a fixed-size
> > length, so check_object_size() should never have been called in the
> > first place. In order for check_object_size() to see that the length is
> > a fixed size, inline copy_from_user_nmi(), as already done with all the
> > other uaccess helpers.
> >
>
> Why is this so complicated.
>
> There's virtually zero value in running all those debug checks from within
> copy_from_user_nmi().
>
> --- a/arch/x86/lib/usercopy.c~a
> +++ a/arch/x86/lib/usercopy.c
> @@ -44,7 +44,7 @@ copy_from_user_nmi(void *to, const void
> * called from other contexts.
> */
> pagefault_disable();
> - ret = __copy_from_user_inatomic(to, from, n);
> + ret = raw_copy_from_user(to, from, n);
> pagefault_enable();
>
> return ret;

I'm with Andrew here; this looks a *LOT* saner than all the other stuff.