From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.200 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793051580; b=4ALTbLvN6ism/8Ayvjm9IfH120htQ6hKvFQ/P2FyjzN8HtNbxOctH6KioxpyUqKA3p0V cQe9YfPUx0lDPJT6GWhk8LtMaHKkSIINEENeQxLpDhSbfNYMtbBJmf65jBTsR/BqTTbe5 bwIJ/XcvdrBjl1iZZzg+6qSEy5+nSlvCtyHUeCRMj8ZgdlCfe1jYfO9xs5S7cwNGRvC/L AS4wlj6gG+12eQJlxxwKy9R0dNlt4Zcx1LyM9PVZNtYDUIye9NZDTHuBRHT/KLxz4++/k x9VveKP9RK1C+DCS5ye3gq9uMCtI5k6W4xaEzxq9upTDim8Y5Nh6lVaAjdeCQlknSeQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793051580; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=bFIgocNkSNISRV4CHBI3t0UD1tr56XsmI6e/PuL6mFQ=; b=jp+QFiV5+w0gXe/buL5pY39OVlix8k54wEcvsc7VzHEKe3vPuMMmgqSqc9/E1djOD6M+ gzjhMnKKPSCa3KnHgqiXn4w0rIE9WN980dOfHMzFrdpmO0ce2GAexp6Unn5qw+4nqmxps GiX+806FqrGL/DLzWscnjjNAJEbWrIYeG15ay3eL9B7NamTVUFpEe+HUT+l6HuH9K8D/4 McNtY8BgDYOfNBXuH/5gpb+CPb9TX5NfZQI+Q/EuCwphvi9uZt9Sat0KcVcI+oiKAKBB3 jyuGa0aHccfwasRt8hltBMH0p/UxBrtvUxDyclGgo8d1vMpq76j0t8dFIW34mKPQToA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--jthoughton.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b="HZDE5/h8"; arc=none smtp.remote-ip=209.85.214.200 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7BF38606AB11 for ; Mon, 26 Oct 2026 21:52:55 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 7BF38606AB11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--jthoughton.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=HZDE5/h8 Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2df8484f12cso33290715ad.3 for ; Mon, 26 Oct 2026 14:52:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1793051575; x=1793656375; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=bFIgocNkSNISRV4CHBI3t0UD1tr56XsmI6e/PuL6mFQ=; b=HZDE5/h8w3OLnXIxK6aJgBJe5iwYfPAwmjEpbW/4ftuyFH9ujuIrSw0dznV9OUyE6F vLLrtdw5C1f/2X+KE5a5AjTR0OVlTErAcMYLlhQ5t2W88/kgSbZ50jbWTAgaZjq8AYcS 4LLCa+on0oJ7TLoL82cJ6x9U3nUI29G0f4PX+yu671qzXzwpuN6+UwWx7JShwc/LkLfM GRw34cZFEGEcFhzeutRJqBfkALCNUgi6P0+zbacA4vpG0KwtbVgvsMdzT9Ez5Kd0LgzS r7YDxe2JSHaiPCcL0fARduZEtNb5N686qJeDu/bTRdIxd0MlXDFjjdccfXbzfnsu4WZc oRRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793051575; x=1793656375; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bFIgocNkSNISRV4CHBI3t0UD1tr56XsmI6e/PuL6mFQ=; b=ux8teEK5U09Cke9Z54t+MglSSOYKvk8SoVqx9GEyu9/XDsD6oF6EjZ8qTCCd/hg4xb G4BRs07hjSfhZQiflS08oUPtAcuI73+p0APr2MH01W5wEc2EsOMWQoauAMIPh1mqXuw6 uSMkRfP5TaNrQ5k/y5nOFa+T5K960gs8jsIQ3o6KgG5Ht9APe403j2nlKU/eDJ7RGpwD eCD5wCFeEMb8kCv/NppRhLbsTj3Xm/uoNr9eWpNqJ64GYkLsrOdS+YHYshawHxDeFEAa qFIAzlIzpL8TwEBPA6wbfQ0LmuHl/3D8DT3WurVAxdPYiFuKkkHS4zGumMDtkdpeETnQ xnKg== X-Forwarded-Encrypted: i=1; AKwUvByy+HZpFUMBptbXGTJNmR9Bk7CJU3LfmcV1AALSvXUjxLOHFVX4kokbQmgZjQDuDt8qK93ognQxxcx+29bS9XMD@vger.kernel.org X-Gm-Message-State: AFq9FYIUjZP+PBIzPo+EI1i+V7q+oPsK7h+mFmSsiuPg6cL3MYuYDoAr 7NGG6ae95hRF4tx8b9gVxUPKLSvbX3KQCmL2AYObR5irH4Y/LqZkDNoaoRq5lxwosj5gr1e9TkS nLf4I1WRZ8fRzXGNiu7hfQg== X-Received: from plblg15.prod.google.com ([2002:a17:902:fb8f:b0:2e5:712c:5c7]) (user=jthoughton job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:ebc8:b0:2e2:e0f8:e57c with SMTP id d9443c01a7336-2ea9c95ba58mr63848015ad.70.1793051574627; Mon, 26 Oct 2026 14:52:54 -0700 (PDT) Date: Mon, 26 Oct 2026 21:52:24 +0000 In-Reply-To: <20261026215226.3713941-1-jthoughton@google.com> X-Mailing-List: linux-perf-users@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261026215226.3713941-1-jthoughton@google.com> X-Mailer: git-send-email 2.56.0.307.g5fe7bd680c-goog Message-ID: <20261026215226.3713941-9-jthoughton@google.com> Subject: [RFC PATCH 08/10] uaccess: Refuse and warn on __copy_from_user_inatomic() without an mm From: James Houghton To: Andrew Morton , Alexander Viro Cc: Thomas Gleixner , Peter Zijlstra , Kees Cook , Arnd Bergmann , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Sean Christopherson , Paolo Bonzini , Jim Mattson , Jens Axboe , Pavel Begunkov , "James E.J. Bottomley" , "Martin K. Petersen" , David Sterba , Chris Mason , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Josh Poimboeuf , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, kvm@vger.kernel.org, io-uring@vger.kernel.org, linux-scsi@vger.kernel.org, linux-btrfs@vger.kernel.org, bpf@vger.kernel.org, linux-trace-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, James Houghton Content-Type: text/plain; charset="UTF-8" __copy_from_user_inatomic() never called should_fail_usercopy(), so the NULL current->mm check added to uaccess_should_fail() does not cover it. It is used e.g. by KVM's kvm_read_guest_atomic(), by several architectures' perf callchain and stack trace code, and by the generic copy_from_user_inatomic_nontemporal(). Split the NULL mm check out of uaccess_should_fail() into uaccess_without_mm(), and use it in __copy_from_user_inatomic() to warn and refuse the copy. Don't use uaccess_should_fail() there, as that would also start injecting failures into __copy_from_user_inatomic(), which some callers don't expect to fail in practice, e.g. __wp_page_copy_user() warns if the copy fails twice. copy_from_user_nofault() already fails quietly when current->mm is NULL, and the generic user stack unwinding entry points (perf_callchain(), get_perf_callchain() and stack_trace_save_user()) only unwind the user stack of a user task with an mm, so neither is affected. Signed-off-by: James Houghton --- include/linux/uaccess.h | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 8ab24e706a22..eae204f7261b 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -51,20 +51,33 @@ #endif /* - * Return true if a user copy must not be attempted, either because a failure - * is being injected, or because the current task has no mm. + * Return true, and warn, if the current task has no mm, in which case user + * memory must not be accessed. * * Accessing user memory without an mm (e.g. from a kernel thread that is not * using kthread_use_mm(), or from a task that has already gone through * exit_mm()) is always a bug: the user portion of the address space belongs to * whatever mm happens to be lazily loaded, if any, so the access could * silently hit another task's memory. + * + * Note that this only catches a missing mm. It cannot catch a valid mm that + * isn't the one the caller expects, e.g. when a file's release or ioctl + * handlers run in a different process than the one that created it. Code + * that keeps user addresses belonging to a specific mm must check + * current->mm against that mm itself (see e.g. KVM's kvm->mm checks). + */ +static __always_inline bool uaccess_without_mm(void) +{ + return WARN_ON_ONCE(!current->mm); +} + +/* + * Return true if a user copy must not be attempted, either because the + * current task has no mm, or because a failure is being injected. */ static __always_inline bool uaccess_should_fail(void) { - if (WARN_ON_ONCE(!current->mm)) - return true; - return should_fail_usercopy(); + return uaccess_without_mm() || should_fail_usercopy(); } /* @@ -117,6 +130,8 @@ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) { unsigned long res; + if (uaccess_without_mm()) + return n; instrument_copy_from_user_before(to, from, n); check_object_size(to, n, false); res = raw_copy_from_user(to, from, n); -- 2.56.0.307.g5fe7bd680c-goog