Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
Date:   Fri, 20 May 2022 03:01:09 +0000
From:   Al Viro <viro@zeniv.linux.org.uk>
To:     Jens Axboe <axboe@kernel.dk>
Cc:     "Jason A. Donenfeld" <Jason@zx2c4.com>,
        LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] random: convert to using fops->write_iter()
Message-ID: <YocEddeThi8VUcKb@zeniv-ca.linux.org.uk>
References: <f871a510-d262-bc98-757e-204976e1b82c@kernel.dk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <f871a510-d262-bc98-757e-204976e1b82c@kernel.dk>
Sender: Al Viro <viro@ftp.linux.org.uk>
Precedence: bulk

On Thu, May 19, 2022 at 05:43:15PM -0600, Jens Axboe wrote:

> -static int write_pool(const char __user *ubuf, size_t len)
> +static size_t write_pool(struct iov_iter *iter)
>  {
>  	size_t block_len;
>  	int ret = 0;
>  
> -	while (len) {
> -		block_len = min(len, sizeof(block));
> -		if (copy_from_user(block, ubuf, block_len)) {
> -			ret = -EFAULT;
> +	while (iov_iter_count(iter)) {
> +		block_len = min(iov_iter_count(iter), sizeof(block));
> +		if (!copy_from_iter(block, block_len, iter)) {
> +			if (!ret)
> +				ret = -EFAULT;
>  			goto out;
>  		}

Feed it a buffer with only 1 byte mapped, watch it'll pass to mix_pool_bytes().
And see how much of 'block' has been used uninitialized...

And why bother with that min thing, anyway?

	ssize_t ret = 0;

	while (iov_iter_count(iter)) {
	  	u8 block[BLAKE2S_BLOCK_SIZE];
		size_t copied = copy_from_iter(block, sizeof(block), iter);
		if (!copied) {
			if (!ret)
				ret = -EFAULT;
			break;
		}
		mix_pool_bytes(block, copied);
		ret += copied;
	}
	return ret;

and be done with that...

> @@ -1382,11 +1378,16 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
>  			return -EINVAL;
>  		if (get_user(size, p++))
>  			return -EFAULT;
> -		retval = write_pool((const char __user *)p, size);
> +
> +		iov.iov_base = p;
> +		iov.iov_len = size;
> +		iov_iter_init(&iter, WRITE, &iov, 1, size);

That'd be
		import_single_range(WRITE, p, size, &iov, &iter);