Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 29 Mar 2023 01:54:37 -0400
From:   Gregory Price <gregory.price@memverge.com>
To:     Oleg Nesterov <oleg@redhat.com>
Cc:     Arnd Bergmann <arnd@arndb.de>,
        Gregory Price <gourry.memverge@gmail.com>,
        linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org,
        linux-arm-kernel@lists.infradead.org,
        Linux-Arch <linux-arch@vger.kernel.org>, avagin@gmail.com,
        Peter Zijlstra <peterz@infradead.org>,
        Andy Lutomirski <luto@kernel.org>, krisman@collabora.com,
        Thomas Gleixner <tglx@linutronix.de>,
        Jonathan Corbet <corbet@lwn.net>, shuah <shuah@kernel.org>,
        Catalin Marinas <catalin.marinas@arm.com>,
        Will Deacon <will@kernel.org>,
        Mark Rutland <mark.rutland@arm.com>, tongtiangen@huawei.com,
        Robin Murphy <robin.murphy@arm.com>
Subject: Re: [PATCH v14 1/4] asm-generic,arm64: create task variant of
 access_ok
Message-ID: <ZCPSnVgvyv3uaAKY@memverge.com>
References: <20230328164811.2451-1-gregory.price@memverge.com>
 <20230328164811.2451-2-gregory.price@memverge.com>
 <20230329151515.GA913@redhat.com>
 <9a456346-e207-44e1-873e-40d21334e01b@app.fastmail.com>
 <20230329160322.GA4477@redhat.com>
 <ZCO20bzX/IB8J6Gp@memverge.com>
 <20230329171322.GB4477@redhat.com>
 <ZCPOpClZ3hOQCs7a@memverge.com>
 <20230329175850.GA8425@redhat.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230329175850.GA8425@redhat.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?h7n8gL+WkGd2No0vxQipaKCFnwSqlqtwFE71vgWrTsce81MfHNsp1Q5SSeXw?=
 =?us-ascii?Q?wmvh7vStm+7orlhslN+cKDDXThafPFbgdkYfXUwJLmA2WQhXXwUqO6z2vKMt?=
 =?us-ascii?Q?7QViI+nMeirSTpM/RejOQ9qD7aKXnQMBaz60ntbhtK/e9Own0Sq9rGCBBEpV?=
 =?us-ascii?Q?RMghnRBin7MP5a7z9ztQt9C/5Q6bdgF7XmYlsfEN0fLBLGOSQa3cqnLVmV86?=
 =?us-ascii?Q?dhH5gHsb9VOtoltHh2Z/6WLvZJp0QL9979D/n9q5N62MXLXwfsK54NfDTG39?=
 =?us-ascii?Q?/l41mZek9a+ZnuixvLpfwZ11ypuUGA+bGEPCYqqm4vOCYBda/VIMYltrNBL2?=
 =?us-ascii?Q?KLQggG0rXiBgef6luRgozpohdV7ht664u5Jt/GUAnf3DQ927MBGffcPsCOGB?=
 =?us-ascii?Q?bdOuHAnHaMsliuVsEgAjNTm8YSC1SSAkolnwEwuCKDwTf6aTUD6rtvJJ5B2p?=
 =?us-ascii?Q?LqCxzADdaaN5YVPqhAcUxsm21s43z1+N3LOdYqliq+TjEUxHeiDBxEEIOYjc?=
 =?us-ascii?Q?MXUSiAhjIyHZmzVaWxYbX1Uk1EgQDyiFb3NqlAxATWtUTOxGRhrQo/s4HyIr?=
 =?us-ascii?Q?5bhzXYKuoJb1EVpbmyfoX8h4btguFsaZ3su5kJf+zb7YQmTndSgT26MIRt1A?=
 =?us-ascii?Q?Gpd2iMrigS4li7K9yQda/nkPzytObQd+W8nCHii9F1TDvpiTyUZ2FDmgoBnK?=
 =?us-ascii?Q?VFU59uD4rfByO0y99v4olNEq2OEexB51RyqZA9Btd8IBDUJs5Qe5ffWxwNSg?=
 =?us-ascii?Q?r8diWC+n3Gi8pj8EH73zehVeZSLWsHtSp5riQ0bYCtDZ20gtF+VM3+3dBb7C?=
 =?us-ascii?Q?f72MIjAD0HrtrtaHEQ/VhdmvKo2I06eZBFjkDTIC5bY6U1sXBuLUrjxP1RvW?=
 =?us-ascii?Q?JTUgLKOS5mDPSX7gjV6rGbjoPz8qTaSRqHXhQLmFKVhNT+ylhf+wZqKu/Qgi?=
 =?us-ascii?Q?Apmcl1O3fcCBPNx81Uevj17Rga5xJYvprGL3P8eNkBry2g0UepB/vPk1gFU5?=
 =?us-ascii?Q?VMx+xLHqE5PS9QEMtuIKph1G28t72CM0YMPAP4bFDEyaj/7qluYb7fukqQaO?=
 =?us-ascii?Q?+4Ne/FxxSne9ojdGgf9ddD4pYLSL9peV+Tdiiu6gO9Mfzgp8kr5am17ZXVS0?=
 =?us-ascii?Q?iJ2WT3OHex5jd8DC/xZHIWLqD+cFaA9adiKDRvMDy40H4icXzezMvZNFKnzE?=
 =?us-ascii?Q?lTc0Y9mOK0I+Z0yI29e5gx3WJIvjFk6Po3So1lmfzM9ypWstPJ+fQe+oQNyE?=
 =?us-ascii?Q?goq2lMwX8Wk/RGWy0T60Q7DUBOhybVICGueMBTk0vMXEabxRZbw9adVrb5PO?=
 =?us-ascii?Q?DeAf0jyuLNBK/OYFqxW+dSlAZHAxKDsXVKWY/VxkPHHJSwbjyw3vEvEGaV/X?=
 =?us-ascii?Q?q6trsUvlh4JZ1PKrRXMz+8KozlcfQafvOquWYww0J57fn73ULtbcRXnuVg6q?=
 =?us-ascii?Q?uun6cx4IY8bvuA7ROqRtwVy5TMY0dGZ5TEwJH54AxxYhPGE3HGCz0oA9cGhX?=
 =?us-ascii?Q?JrbEjvq3+6HrarlgWhry943KOdzvvpUvy2gVfSNW5/ElcYK97thbH9lorqyC?=
 =?us-ascii?Q?4NyXGlmCCKuXGsAgMMJ1otOXDG8DtiXo1+WzRPXeTDuu6cgDERMqYzHmGBrC?=
 =?us-ascii?Q?2Q=3D=3D?=
X-OriginatorOrg: memverge.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e9720e03-3302-499d-1e6d-08db307fd1c5
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR17MB5512.namprd17.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Mar 2023 18:02:54.3894
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 5c90cb59-37e7-4c81-9c07-00473d5fb682
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: s0ePGMqsylr6Ki4QqgnKO8bcKLGnQQ+PTHalCusZhvPbar5WZPkEgRbXG/UHzeyGlWuGQTudd797DaCyDciB57KFFrCI4btHCK5kuyTgg8Q=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR17MB4058
X-Spam-Status: No, score=0.6 required=5.0 tests=DATE_IN_PAST_12_24,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE
        autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Wed, Mar 29, 2023 at 07:58:51PM +0200, Oleg Nesterov wrote:
> On 03/29, Gregory Price wrote:
> >
> > On Wed, Mar 29, 2023 at 07:13:22PM +0200, Oleg Nesterov wrote:
> > >
> > > -		if (selector && !access_ok(selector, sizeof(*selector)))
> > > -			return -EFAULT;
> > > -
> > >  		break;
> > >  	default:
> > >  		return -EINVAL;
> > >
> >
> > The result of this would be either a task calling via prctl or a tracer
> > calling via ptrace would be capable of setting selector to a bad pointer
> > and producing a SIGSEGV on the next system call.
> 
> Yes,
> 
> > It's a pretty small footgun, but maybe that's reasonable?
> 
> I hope this is reasonable,
> 
> > From a user perspective, debugging this behavior would be nightmarish.
> > Your call to prctl/ptrace would succeed and the process would continue
> > to execute until the next syscall - at which point you incur a SIGSEGV,
> 
> Yes. But how does this differ from the case when, for example, user
> does prtcl(PR_SET_SYSCALL_USER_DISPATCH, selector = 1) ? Or another
> bad address < TASK_SIZE?
> 
> access_ok() will happily succeed, then later syscall_user_dispatch()
> will equally trigger SIGSEGV.
> 
> Oleg.
> 

I'm convinced now, this feels like the correct solution.  I will pull
your suggested patch ahead and drop the task variant of access_ok.

Am I ok to add your signed-off-by to the suggested patch, and i'll add
it to the series?  Not quite sure what the correct set of tags is,
since i don't have any suggested changes to your patch.

~Gregory