Received-SPF: pass (google.com: domain of linux-kernel+bounces-206428-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Fri, 7 Jun 2024 17:52:12 +0200
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Andy Lutomirski <luto@amacapital.net>
Cc: linux-kernel@vger.kernel.org, patches@lists.linux.dev,
	tglx@linutronix.de, linux-crypto@vger.kernel.org,
	linux-api@vger.kernel.org, x86@kernel.org,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>,
	Carlos O'Donell <carlos@redhat.com>,
	Florian Weimer <fweimer@redhat.com>, Arnd Bergmann <arnd@arndb.de>,
	Jann Horn <jannh@google.com>,
	Christian Brauner <brauner@kernel.org>,
	David Hildenbrand <dhildenb@redhat.com>
Subject: Re: [PATCH v16 4/5] random: introduce generic vDSO getrandom()
 implementation
Message-ID: <ZmMsrHWTLMS4W08w@zx2c4.com>
References: <20240528122352.2485958-1-Jason@zx2c4.com>
 <20240528122352.2485958-5-Jason@zx2c4.com>
 <CALCETrUgPwVsMwkxkCyuqBKyqouyejikxxyGuBDxnWWKskYG8A@mail.gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CALCETrUgPwVsMwkxkCyuqBKyqouyejikxxyGuBDxnWWKskYG8A@mail.gmail.com>

On Fri, May 31, 2024 at 04:06:37PM -0700, Andy Lutomirski wrote:
> > On May 28, 2024, at 5:25 AM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
> >
> > Provide a generic C vDSO getrandom() implementation, which operates on
> > an opaque state returned by vgetrandom_alloc() and produces random bytes
> > the same way as getrandom(). This has a the API signature:
> >
> >  ssize_t vgetrandom(void *buffer, size_t len, unsigned int flags, void *opaque_state);
> 
> > +/**
> > + * type vdso_kernel_ulong - unsigned long type that matches kernel's unsigned long
> > + *
> > + * Data shared between userspace and the kernel must operate the same way in both 64-bit code and in
> > + * 32-bit compat code, over the same potentially 64-bit kernel. This type represents the size of an
> > + * unsigned long as used by kernel code. This isn't necessarily the same as an unsigned long as used
> > + * by userspace, however.
> 
> Why is this better than using plain u64?  It’s certainly more
> complicated. It also rather fundamentally breaks CRIU on 32-bit
> userspace (although CRIU may well be unable to keep vgetrandom working
> after a restore onto a different kernel anyway).  Admittedly 32-bit
> userspace is a slowly dying breed, but still.

That came out of this conversation: https://lore.kernel.org/all/878rjs7mcx.fsf@oldenburg.str.redhat.com/
(And I'd like single instruction increments, which means long, not u64
on 32-bit machines.)

> > +{
> > +    ssize_t ret = min_t(size_t, INT_MAX & PAGE_MASK /* = MAX_RW_COUNT */, len);
> > +    struct vgetrandom_state *state = opaque_state;
> > +    size_t batch_len, nblocks, orig_len = len;
> > +    unsigned long current_generation;
> > +    void *orig_buffer = buffer;
> > +    u32 counter[2] = { 0 };
> > +    bool in_use, have_retried = false;
> > +
> > +    /* The state must not straddle a page, since pages can be zeroed at any time. */
> > +    if (unlikely(((unsigned long)opaque_state & ~PAGE_MASK) + sizeof(*state) > PAGE_SIZE))
> > +        goto fallback_syscall;
> 
> This is weird. Either the provided pointer is valid or it isn’t.
> Reasonable outcomes are a segfault if the pointer is bad or success
> (or fallback if needed for some reason) if the pointer is good.  Why
> is there specific code to catch a specific sort of pointer screwup
> here?

I guess I could make it return -EFAULT in this case, rather than
silently succeeding.

Jason