The removal of compat_process_vm_{readv,writev} didn't change
process_vm_rw(), which always assumes it's not doing a compat syscall.
Instead of passing in 'false' unconditionally for 'compat', make it
conditional on in_compat_syscall().
Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}")
Reported-by: Kyle Huey <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
---
diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
index fd12da80b6f2..05676722d9cd 100644
--- a/mm/process_vm_access.c
+++ b/mm/process_vm_access.c
@@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid,
return rc;
if (!iov_iter_count(&iter))
goto free_iov_l;
- iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, false);
+ iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r,
+ in_compat_syscall());
if (IS_ERR(iov_r)) {
rc = PTR_ERR(iov_r);
goto free_iov_l;
--
Jens Axboe
On Mon, Oct 26, 2020 at 5:03 PM Jens Axboe <[email protected]> wrote:
>
> The removal of compat_process_vm_{readv,writev} didn't change
> process_vm_rw(), which always assumes it's not doing a compat syscall.
> Instead of passing in 'false' unconditionally for 'compat', make it
> conditional on in_compat_syscall().
>
> Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}")
> Reported-by: Kyle Huey <[email protected]>
> Signed-off-by: Jens Axboe <[email protected]>
>
> ---
>
> diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
> index fd12da80b6f2..05676722d9cd 100644
> --- a/mm/process_vm_access.c
> +++ b/mm/process_vm_access.c
> @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid,
> return rc;
> if (!iov_iter_count(&iter))
> goto free_iov_l;
> - iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, false);
> + iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r,
> + in_compat_syscall());
> if (IS_ERR(iov_r)) {
> rc = PTR_ERR(iov_r);
> goto free_iov_l;
>
> --
> Jens Axboe
>
I tested this patch and it does fix the original testcase I reported.
- Kyle
On Tue, Oct 27, 2020 at 12:09:20AM +0000, Al Viro wrote:
> On Mon, Oct 26, 2020 at 06:03:18PM -0600, Jens Axboe wrote:
> > The removal of compat_process_vm_{readv,writev} didn't change
> > process_vm_rw(), which always assumes it's not doing a compat syscall.
> > Instead of passing in 'false' unconditionally for 'compat', make it
> > conditional on in_compat_syscall().
> >
> > Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}")
> > Reported-by: Kyle Huey <[email protected]>
> > Signed-off-by: Jens Axboe <[email protected]>
>
> ACK with some reservations - I suspect that we want an explicit flag
> for process_vm_{read,write}v() that would force the 64bit layout for
> the vector refering to the foreign process. It's not relevant for
> regression fix; however, as it is these syscalls are not usable for
> 32bit process trying to access memory of 64bit one - there's no way
> to specify the addresses past 4G.
Independent of this fix I think we just need to explicitly prohibit
cross-access.
On Mon, Oct 26, 2020 at 06:03:18PM -0600, Jens Axboe wrote:
> The removal of compat_process_vm_{readv,writev} didn't change
> process_vm_rw(), which always assumes it's not doing a compat syscall.
> Instead of passing in 'false' unconditionally for 'compat', make it
> conditional on in_compat_syscall().
>
> Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}")
> Reported-by: Kyle Huey <[email protected]>
> Signed-off-by: Jens Axboe <[email protected]>
ACK with some reservations - I suspect that we want an explicit flag
for process_vm_{read,write}v() that would force the 64bit layout for
the vector refering to the foreign process. It's not relevant for
regression fix; however, as it is these syscalls are not usable for
32bit process trying to access memory of 64bit one - there's no way
to specify the addresses past 4G.
Looks good,
Reviewed-by: Christoph Hellwig <[email protected]>
On Tue, Oct 27, 2020 at 1:01 AM Christoph Hellwig <[email protected]> wrote:
>
> Independent of this fix I think we just need to explicitly prohibit
> cross-access.
Well, prohibiting a 32-bit process from accessing a 64-bit one might
make sense, since it fundamentally cannot work, and returning an
explicit error early might help avoid confusion.
But a 64-bit one can certainly validly look at a 32-bit one (ie
debugging a compat process from a 64-bit gdb or similar is not
unreasonable).
That said, I wonder how muich of a problem that can be, so it may be
sufficient to just fix this compat case up and leave it alone.
So applied,
Linus
On Mo, 26. Okt 18:03, Jens Axboe wrote:
> The removal of compat_process_vm_{readv,writev} didn't change
> process_vm_rw(), which always assumes it's not doing a compat syscall.
> Instead of passing in 'false' unconditionally for 'compat', make it
> conditional on in_compat_syscall().
>
> Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}")
> Reported-by: Kyle Huey <[email protected]>
> Signed-off-by: Jens Axboe <[email protected]>
>
> ---
>
> diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
> index fd12da80b6f2..05676722d9cd 100644
> --- a/mm/process_vm_access.c
> +++ b/mm/process_vm_access.c
> @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid,
> return rc;
> if (!iov_iter_count(&iter))
> goto free_iov_l;
> - iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, false);
> + iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r,
> + in_compat_syscall());
> if (IS_ERR(iov_r)) {
> rc = PTR_ERR(iov_r);
> goto free_iov_l;
>
> --
> Jens Axboe
>
Hello Jens,
i got the following error when i try to build.
m/process_vm_access.c: In Funktion ?process_vm_rw?:
mm/process_vm_access.c:277:5: Fehler: Implizite Deklaration der Funktion ?in_compat_syscall?; meinten Sie ?in_ia32_syscall?? [-Werror=implicit-function-declaration]
277 | in_compat_syscall());
| ^~~~~~~~~~~~~~~~~
| in_ia32_syscall
--
VG
Damian Tometzki
On Wed, 28 Oct 2020 at 00:49, damian
<[email protected]> wrote:
>
> On Mo, 26. Okt 18:03, Jens Axboe wrote:
> > The removal of compat_process_vm_{readv,writev} didn't change
> > process_vm_rw(), which always assumes it's not doing a compat syscall.
> > Instead of passing in 'false' unconditionally for 'compat', make it
> > conditional on in_compat_syscall().
> >
> > Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}")
> > Reported-by: Kyle Huey <[email protected]>
> > Signed-off-by: Jens Axboe <[email protected]>
> >
> > ---
> >
> > diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
> > index fd12da80b6f2..05676722d9cd 100644
> > --- a/mm/process_vm_access.c
> > +++ b/mm/process_vm_access.c
> > @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid,
> > return rc;
> > if (!iov_iter_count(&iter))
> > goto free_iov_l;
> > - iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, false);
> > + iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r,
> > + in_compat_syscall());
> > if (IS_ERR(iov_r)) {
> > rc = PTR_ERR(iov_r);
> > goto free_iov_l;
> >
> > --
> > Jens Axboe
> >
> Hello Jens,
>
> i got the following error when i try to build.
>
> m/process_vm_access.c: In Funktion »process_vm_rw«:
> mm/process_vm_access.c:277:5: Fehler: Implizite Deklaration der Funktion »in_compat_syscall«; meinten Sie »in_ia32_syscall«? [-Werror=implicit-function-declaration]
> 277 | in_compat_syscall());
> | ^~~~~~~~~~~~~~~~~
> | in_ia32_syscall
>
I have also noticed this build failure on Linus's mainline master branch.
x86_64 : FAILED
i386: FAILED
arm: FAILED
make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=x86 HOSTCC=gcc
CC="sccache gcc" O=build
50../mm/process_vm_access.c: In function ‘process_vm_rw’:
51../mm/process_vm_access.c:277:5: error: implicit declaration of
function ‘in_compat_syscall’; did you mean ‘in_ia32_syscall’?
[-Werror=implicit-function-declaration]
52 277 | in_compat_syscall());
53 | ^~~~~~~~~~~~~~~~~
54 | in_ia32_syscall
55cc1: some warnings being treated as errors
Reported-by: Naresh Kamboju <[email protected]>
full test build log:
https://gitlab.com/Linaro/lkft/mirrors/torvalds/linux-mainline/-/jobs/815202967
--
Linaro LKFT
https://lkft.linaro.org
On 10/27/20 1:19 PM, damian wrote:
> On Mo, 26. Okt 18:03, Jens Axboe wrote:
>> The removal of compat_process_vm_{readv,writev} didn't change
>> process_vm_rw(), which always assumes it's not doing a compat syscall.
>> Instead of passing in 'false' unconditionally for 'compat', make it
>> conditional on in_compat_syscall().
>>
>> Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}")
>> Reported-by: Kyle Huey <[email protected]>
>> Signed-off-by: Jens Axboe <[email protected]>
>>
>> ---
>>
>> diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
>> index fd12da80b6f2..05676722d9cd 100644
>> --- a/mm/process_vm_access.c
>> +++ b/mm/process_vm_access.c
>> @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid,
>> return rc;
>> if (!iov_iter_count(&iter))
>> goto free_iov_l;
>> - iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, false);
>> + iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r,
>> + in_compat_syscall());
>> if (IS_ERR(iov_r)) {
>> rc = PTR_ERR(iov_r);
>> goto free_iov_l;
>>
>> --
>> Jens Axboe
>>
> Hello Jens,
>
> i got the following error when i try to build.
>
> m/process_vm_access.c: In Funktion »process_vm_rw«:
> mm/process_vm_access.c:277:5: Fehler: Implizite Deklaration der Funktion »in_compat_syscall«; meinten Sie »in_ia32_syscall«? [-Werror=implicit-function-declaration]
> 277 | in_compat_syscall());
> | ^~~~~~~~~~~~~~~~~
> | in_ia32_syscall
Yeah, sorry about that. Geert sent out a fix:
https://lore.kernel.org/lkml/[email protected]/
--
Jens Axboe