Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CAHk-=wjc-ktbOr7ZHMY8gfAmHxUK+aMdDsQjeh+BvmQwnQfN_g@mail.gmail.com>
 <20200701184131.GI2786714@ZenIV.linux.org.uk> <CAHk-=wj_2v9m+yZioE4vOLGW1mc9SBa5+++LdeJ86aEeB5OXcw@mail.gmail.com>
 <20200701195914.GK2786714@ZenIV.linux.org.uk>
In-Reply-To: <20200701195914.GK2786714@ZenIV.linux.org.uk>
From:   Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed, 1 Jul 2020 13:25:36 -0700
Message-ID: <CAHk-=wj-CYhKZR8ZKQgi=VTx=o7n6dtwPXikvgkJ3SdiqRPd8A@mail.gmail.com>
Subject: Re: objtool clac/stac handling change..
To:     Al Viro <viro@zeniv.linux.org.uk>,
        Christophe Leroy <christophe.leroy@c-s.fr>,
        Michael Ellerman <mpe@ellerman.id.au>
Cc:     Josh Poimboeuf <jpoimboe@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>,
        "the arch/x86 maintainers" <x86@kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Wed, Jul 1, 2020 at 12:59 PM Al Viro <viro@zeniv.linux.org.uk> wrote:
>
> On Wed, Jul 01, 2020 at 12:04:36PM -0700, Linus Torvalds wrote:
> >
> > That's actually for the access granting. Shutting the access down ends
> > up always doing the same thing anyway..
>
> #define user_read_access_end            prevent_current_read_from_user
> #define user_write_access_end           prevent_current_write_to_user
> static inline void prevent_current_read_from_user(void)
> {
>         prevent_user_access(NULL, NULL, ~0UL, KUAP_CURRENT_READ);
> }
>
> static inline void prevent_current_write_to_user(void)
> {
>         prevent_user_access(NULL, NULL, ~0UL, KUAP_CURRENT_WRITE);
> }
>
> and prevent_user_access() has instances that do care about the direction...

Go and look closer.

There are three cases:

 (a) the 32-bit book3s case. It looks like it cares, but when you look
closer, it ends up not caring about the read side, and saving the
"which address to I allow user writes to" in current->thread.kuap

 (b) the nohash 32-bit case - doesn't care

 (c) the 64-bit books case - doesn't care

So yes, in the (a) case it does make a difference between reads and
writes, but at least as far as I can tell, it ignores the read case,
and has code to avoid the unnecessary "disable user writes" case when
there was only a read enable done.

Now, it's possible that I'm wrong, but the upshot of that is that even
on powerpc, I think that if we just made the rule be that "taking a
user exception should automatically do the 'user_access_end()' for us"
is trivial.

But I'll add the powerpc people to the list too. And the arm64 people
too, although it looks like they still haven't actually made the
uaccess_disable() logic visible as user_access_begin/end and the
unsafe_xyz code, so they'd not be impacted.

Christophe/Michael: the discussion is that I'd actually want to change
the "exception on user access" case to do the user_access_end()
automatically, so that you can write code like

        if (!user_access_begin(...))
                goto out;

        unsafe_get_user(..., out);
        unsafe_get_user(..., out);

        user_access_end();
        .. all is good, use the value we got..
        return 0;

out:
        return -EFAULT;

and use the same error label for both the "user_access_begin() failed"
_and_ for the "oops, the access faulted".

Right now the code needs to explicitly do the user_access_end()
handling manually if one of the accesses fault.

See for example fs/readdir.c, which has that

     efault_end:
             user_write_access_end();
     efault:
             buf->result = -EFAULT;
             return -EFAULT;

pattern of two different error targets several times. I'd like to
avoid that user_{read_,write_,}access_end() case for the error
handling entirely. It's extra complexity.

I checked every single non-arch user, and for all of them it was just
extra work (eg i915 driver, readdir, select, etc)

The only case it wasn't an extra bother was the
lib/strn{cpy,len}_from_user() cases, but that was because I literally
organized the code to call a helper function be called in such a way
that it always did the right thing.

                Linus