Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (1.0)
Subject: Re: [PATCH 1/2 v2] kprobe: Do not use uaccess functions to access kernel memory that can fault
From:   Andy Lutomirski <luto@amacapital.net>
In-Reply-To: <CAHk-=whX6LLVn_q2DC0K37iQgZ4S0LX6mR46+O2TNufJuR-K6Q@mail.gmail.com>
Date:   Fri, 22 Feb 2019 11:52:36 -0800
Cc:     Masami Hiramatsu <mhiramat@kernel.org>,
        Steven Rostedt <rostedt@goodmis.org>,
        Linux List Kernel Mailing <linux-kernel@vger.kernel.org>,
        Ingo Molnar <mingo@kernel.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        stable <stable@vger.kernel.org>,
        Changbin Du <changbin.du@gmail.com>,
        Jann Horn <jannh@google.com>,
        Kees Cook <keescook@chromium.org>,
        Andy Lutomirski <luto@kernel.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <2561D633-DE6C-4E74-8EBD-B743D0141054@amacapital.net>
References: <20190215174712.372898450@goodmis.org> <20190215174945.557218316@goodmis.org> <CAHk-=wjP4bEYCFaKZVG4kLWmYBctyfsW9jjhC91tiTk9WwB8Rg@mail.gmail.com> <20190215171539.4682f0b4@gandalf.local.home> <300C4516-A093-43AE-8707-1C42486807A4@amacapital.net> <20190215191949.04604191@gandalf.local.home> <CAHk-=wgJzNp0R3cVhjBPHTR4X9sOvHdqK4UVFfbsOKQ6L=A_eQ@mail.gmail.com> <CAHk-=wh9XrOykA5J9RQ7zaBio-S_D+1AE+rGnBYWSd==pCXh+w@mail.gmail.com> <20190219111802.1d6dbaa3@gandalf.local.home> <CAHk-=wgTuK3kAduP-gr10vykT1uG=B2VpdffvmyBuTQ1UxPpMg@mail.gmail.com> <20190219140330.5dd9e876@gandalf.local.home> <20190220171019.5e81a4946b56982f324f7c45@kernel.org> <20190220094926.0ab575b3@gandalf.local.home> <20190222172745.2c7205d62003c0a858e33278@kernel.org> <20190222173509.88489b7c5d1bf0e2ec2382ee@kernel.org> <CAHk-=whNf_n1WXWW+ugAVeL5ZK0GcEP3cTYocju1nS85VtMjjQ@mail.gmail.com> <AD9148E4-00CC-4711-82D3-957D28497057@amacapital.net> <CAHk-=whX6LLVn_q2DC0K37iQgZ4S0LX6mR46+O2TNufJuR-K6Q@mail.gmail.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Feb 22, 2019, at 10:28 AM, Linus Torvalds <torvalds@linux-foundation.or=
g> wrote:
>=20
>> On Fri, Feb 22, 2019 at 9:48 AM Andy Lutomirski <luto@amacapital.net> wro=
te:
>>=20
>>> On Feb 22, 2019, at 9:43 AM, Linus Torvalds <torvalds@linux-foundation.o=
rg> wrote:
>>>=20
>>> Then we should still probably fix up "__probe_kernel_read()" to not
>>> allow user accesses. The easiest way to do that is actually likely to
>>> use the "unsafe_get_user()" functions *without* doing a
>>> uaccess_begin(), which will mean that modern CPU's will simply fault
>>> on a kernel access to user space.
>>>=20
>>> The nice thing about that is that usually developers will have access
>>> to exactly those modern boxes, so the people who notice that it
>>> doesn't work are the right people.
>>=20
>> We use probe_kernel_read() from oops code. I=E2=80=99d rather it return -=
EFAULT than oops harder and kill the first oops.
>=20
> It would still do that.
>=20
> Using the unsafe_get_user() macros doesn't remove the exception
> handling, and we wouldn't remove the whole "pagefault_disable()"
> either. So it would work exactly the same way it does now, except on a
> modern CPU it would return -EFAULT for a user space access due to AC
> not being set.
>=20
>=20

Hmm. I misunderstood you. I thought you wanted the oops.

We=E2=80=99d have to check that we don=E2=80=99t trip the =E2=80=9CSMAP viol=
ation, egads!=E2=80=9D check.=20=