Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934708AbdC3TTj (ORCPT ); Thu, 30 Mar 2017 15:19:39 -0400 Received: from mail-it0-f68.google.com ([209.85.214.68]:36299 "EHLO mail-it0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934299AbdC3TTh (ORCPT ); Thu, 30 Mar 2017 15:19:37 -0400 MIME-Version: 1.0 In-Reply-To: <20170330191009.GU29622@ZenIV.linux.org.uk> References: <20170329055706.GH29622@ZenIV.linux.org.uk> <20170330162241.GG7909@n2100.armlinux.org.uk> <20170330164342.GR29622@ZenIV.linux.org.uk> <20170330184824.GS29622@ZenIV.linux.org.uk> <20170330185427.GT29622@ZenIV.linux.org.uk> <20170330191009.GU29622@ZenIV.linux.org.uk> From: Linus Torvalds Date: Thu, 30 Mar 2017 12:19:35 -0700 X-Google-Sender-Auth: TYal-0aeuixHRfQEqFX6HJqZSU8 Message-ID: Subject: Re: [RFC][CFT][PATCHSET v1] uaccess unification To: Al Viro Cc: Russell King - ARM Linux , "linux-arch@vger.kernel.org" , Linux Kernel Mailing List , Richard Henderson , Will Deacon , Haavard Skinnemoen , Vineet Gupta , Steven Miao , Jesper Nilsson , Mark Salter , Yoshinori Sato , Richard Kuo , Tony Luck , Geert Uytterhoeven , James Hogan , Michal Simek , David Howells , Ley Foon Tan , Jonas Bonn , Helge Deller , Martin Schwidefsky , Ralf Baechle , Benjamin Herrenschmidt , Chen Liqin , "David S. Miller" , Chris Metcalf , Richard Weinberger , Guan Xuetao , Thomas Gleixner , Chris Zankel Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1073 Lines: 29 On Thu, Mar 30, 2017 at 12:10 PM, Al Viro wrote: > > That they very definitely should not. And not because of access_ok() or > might_fault() - this is one place where zero-padding is absolutely wrong. > So unless you are going to take it out of copy_from_user() and pray > that random shit ioctls in random shit drivers check the return value > properly, copy_from_user() is no-go here. Actually, that is a great example of why you should *not* use __copy_from_user(). If the reason is lack of zero-padding, that doesn't mean that suddenly we shouldn't check the range. And it doesn't mean that it shouldn't document why it does it. So dammit, just add something like this to lib/iovec.c: static inline unsigned long copy_from_user_nozero(void *to, const void __user *from, size_t len) { if (!access_ok(from, len)) return len; return __copy_from_user(to, from, len); } which now isn't insecure, and also magically documents *why* you don't just use the plain copy_from_user(). Linus