Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: Question on "uaccess: Add strict non-pagefault kernel-space read
 function"
To:     Christoph Hellwig <hch@infradead.org>
Cc:     Alexei Starovoitov <ast@kernel.org>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Masami Hiramatsu <mhiramat@kernel.org>, x86@kernel.org,
        linux-kernel@vger.kernel.org, bpf@vger.kernel.org,
        bgregg@netflix.com
References: <20200403133533.GA3424@infradead.org>
 <5ddc8c04-279d-9a14-eaa7-755467902ead@iogearbox.net>
 <20200404093105.GA445@infradead.org>
 <2adc77e1-e84d-f303-fd88-133ec950c33f@iogearbox.net>
 <20200407093357.GA24309@infradead.org>
From:   Daniel Borkmann <daniel@iogearbox.net>
Message-ID: <776e5c99-57c9-b61b-d466-412db440a859@iogearbox.net>
Date:   Wed, 8 Apr 2020 02:15:52 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.7.2
MIME-Version: 1.0
In-Reply-To: <20200407093357.GA24309@infradead.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 4/7/20 11:33 AM, Christoph Hellwig wrote:
> On Tue, Apr 07, 2020 at 11:03:23AM +0200, Daniel Borkmann wrote:
>>
>> ... where archs with non-overlapping user and kernel address range would
>> only end up having to implementing kernel_range_ok() check. Or, instead of
>> a generic kernel_range_ok() this could perhaps be more probing-specific as
>> in probe_kernel_range_ok() where this would then also cover the special
>> cases we seem to have in parisc and um. Then, this would allow to get rid
>> of all the __weak aliasing as well which may just be confusing. I could look
>> into coming up with something along these lines. Thoughts?
> 
> FYI, this is what I cooked up a few days ago:
> 
> http://git.infradead.org/users/hch/misc.git/shortlog/refs/heads/maccess-fixups
> 
> Still misses the final work to switch probe_kernel_read to be the
> strict version.  Any good naming suggestion for the non-strict one?

Ah great, thanks for working on it including the cleanups in your branch above.
Good naming suggestion is usually the hardest ... ;-) Maybe adding an _unsafe or
_lax suffix ...

Regarding commits:

* http://git.infradead.org/users/hch/misc.git/commitdiff/019f5d7894711a8046d1d57640d3db47f690c61e

I think the extra HAVE_PROBE_KERNEL_ALLOWED / HAVE_PROBE_KERNEL_STRICT_ALLOWED
reads a bit odd. Could we simply have an equivalent for access_ok() that archs
implement under KERNEL_DS where it covers the allowed/restricted kernel-only range?
Like mentioned earlier e.g. probe_{user,kernel}_range_ok() helpers where the user
one defaults to access_ok() internally and the kernel one contains all the range
restrictions that archs can then define if needed (and if not there could be an
asm-generic `return true` fallback, for example).

* http://git.infradead.org/users/hch/misc.git/commitdiff/2d6070ac749d0af26367892545d1c288cc00823a

This would still need to set dst[0] = '\0' in that case to be consistent with
the other error handling cases there when count > 0.

Thanks,
Daniel