Re: [PATCH v2 1/4] fs/proc/kcore: Avoid bounce buffer for ktext data

David Hildenbrand
2023-03-20T10:00:09Z

On 19.03.23 08:09, Lorenzo Stoakes wrote:
> Commit df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext data")
> introduced the use of a bounce buffer to retrieve kernel text data for
> /proc/kcore in order to avoid failures arising from hardened user copies
> enabled by CONFIG_HARDENED_USERCOPY in check_kernel_text_object().
>
> We can avoid doing this if instead of copy_to_user() we use _copy_to_user()
> which bypasses the hardening check. This is more efficient than using a
> bounce buffer and simplifies the code.
>
> We do so as part an overall effort to eliminate bounce buffer usage in the
> function with an eye to converting it an iterator read.
>
> Signed-off-by: Lorenzo Stoakes <lstoakes@gmail.com>
> ---
> fs/proc/kcore.c | 17 +++++------------
> 1 file changed, 5 insertions(+), 12 deletions(-)
>
> diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
> index 71157ee35c1a..556f310d6aa4 100644
> --- a/fs/proc/kcore.c
> +++ b/fs/proc/kcore.c
> @@ -541,19 +541,12 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
> case KCORE_VMEMMAP:
> case KCORE_TEXT:
> /*
> - * Using bounce buffer to bypass the
> - * hardened user copy kernel text checks.
> + * We use _copy_to_user() to bypass usermode hardening
> + * which would otherwise prevent this operation.
> */
> - if (copy_from_kernel_nofault(buf, (void *)start, tsz)) {
> - if (clear_user(buffer, tsz)) {
> - ret = -EFAULT;
> - goto out;
> - }
> - } else {
> - if (copy_to_user(buffer, buf, tsz)) {
> - ret = -EFAULT;
> - goto out;
> - }
> + if (_copy_to_user(buffer, (char *)start, tsz)) {
> + ret = -EFAULT;
> + goto out;
> }
> break;
> default:

Looks correct to me. The only difference between copy_to_user() and
_copy_to_user() is the check_copy_size() check, that ends up calling
check_kernel_text_object().

Reviewed-by: David Hildenbrand <david@redhat.com>

--
Thanks,

David / dhildenb