Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754386AbaLHTsz (ORCPT ); Mon, 8 Dec 2014 14:48:55 -0500 Received: from mail-qg0-f50.google.com ([209.85.192.50]:54536 "EHLO mail-qg0-f50.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752909AbaLHTsx (ORCPT ); Mon, 8 Dec 2014 14:48:53 -0500 MIME-Version: 1.0 In-Reply-To: <20141208192816.GH22149@ZenIV.linux.org.uk> References: <20141204202011.GO29748@ZenIV.linux.org.uk> <20141208164650.GB29028@node.dhcp.inet.fi> <20141208175805.GB22149@ZenIV.linux.org.uk> <20141208180824.GC22149@ZenIV.linux.org.uk> <20141208182012.GE22149@ZenIV.linux.org.uk> <20141208184632.GG22149@ZenIV.linux.org.uk> <20141208192816.GH22149@ZenIV.linux.org.uk> Date: Mon, 8 Dec 2014 11:48:52 -0800 X-Google-Sender-Auth: 2P-LHZG6a1V_t9oi4cVrt5Y-KsU Message-ID: Subject: Re: [RFC][PATCHES] iov_iter.c rewrite From: Linus Torvalds To: Al Viro Cc: "Kirill A. Shutemov" , Linux Kernel Mailing List , linux-fsdevel , Network Development , "linux-arch@vger.kernel.org" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Dec 8, 2014 at 11:28 AM, Al Viro wrote: > > On x86 it does, but I don't see anything obvious in generic version in > mm/gup.c, so the old code might still have a problem on some architectures. > What am I missing here? Hmm. You may be right. The "access_ok()" is supposed to protect things, but for cases like finit_module() that has explicitly said "kernel addresses are ok", that check doesn't work. Maybe something like this.. diff --git a/mm/gup.c b/mm/gup.c index cd62c8c90d4a..6234b1e6ced9 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -951,6 +951,9 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write, len = (unsigned long) nr_pages << PAGE_SHIFT; end = start + len; + if (unlikely(segment_eq(get_fs(), KERNEL_DS))) + return 0; + if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, start, len))) return 0; Completely untested, obviously. That code isn't even compiled on x86. Adding linux-arch for more comments. (Background: the generic non-x86 "get_user_pages_fast()" function cannot check that the page tables are actually *user* page tables, so..) Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/