Skip to content

Commit eab0c60

Browse files
Christoph Hellwigtorvalds
Christoph Hellwig
authored and
torvalds
committed
maccess: unify the probe kernel arch hooks
Currently architectures have to override every routine that probes kernel memory, which includes a pure read and strcpy, both in strict and not strict variants. Just provide a single arch hooks instead to make sure all architectures cover all the cases. [akpm@linux-foundation.org: fix !CONFIG_X86_64 build] Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/20200521152301.2587579-11-hch@lst.de Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent cd03090 commit eab0c60

File tree

5 files changed

+61
-50
lines changed

5 files changed

+61
-50
lines changed

‎arch/parisc/lib/memcpy.c‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -57,14 +57,10 @@ void * memcpy(void * dst,const void *src, size_t count)
5757
EXPORT_SYMBOL(raw_copy_in_user);
5858
EXPORT_SYMBOL(memcpy);
5959

60-
long probe_kernel_read(void *dst, const void *src, size_t size)
60+
bool probe_kernel_read_allowed(const void *unsafe_src, size_t size, bool strict)
6161
{
62-
unsigned long addr = (unsigned long)src;
63-
64-
if (addr < PAGE_SIZE)
65-
return -EFAULT;
66-
62+
if ((unsigned long)unsafe_src < PAGE_SIZE)
63+
return false;
6764
/* check for I/O space F_EXTEND(0xfff00000) access as well? */
68-
69-
return __probe_kernel_read(dst, src, size);
65+
return true;
7066
}

‎arch/um/kernel/maccess.c‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,13 @@
77
#include <linux/kernel.h>
88
#include <os.h>
99

10-
long probe_kernel_read(void *dst, const void *src, size_t size)
10+
bool probe_kernel_read_allowed(const void *src, size_t size, bool strict)
1111
{
1212
void *psrc = (void *)rounddown((unsigned long)src, PAGE_SIZE);
1313

1414
if ((unsigned long)src < PAGE_SIZE || size <= 0)
15-
return -EFAULT;
16-
15+
return false;
1716
if (os_mincore(psrc, size + src - psrc) <= 0)
18-
return -EFAULT;
19-
20-
return __probe_kernel_read(dst, src, size);
17+
return false;
18+
return true;
2119
}

‎arch/x86/mm/maccess.c‎

Lines changed: 12 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9,35 +9,26 @@ static __always_inline u64 canonical_address(u64 vaddr, u8 vaddr_bits)
99
return ((s64)vaddr << (64 - vaddr_bits)) >> (64 - vaddr_bits);
1010
}
1111

12-
static __always_inline bool invalid_probe_range(u64 vaddr)
12+
bool probe_kernel_read_allowed(const void *unsafe_src, size_t size, bool strict)
1313
{
14+
unsigned long vaddr = (unsigned long)unsafe_src;
15+
16+
if (!strict)
17+
return true;
18+
1419
/*
1520
* Range covering the highest possible canonical userspace address
1621
* as well as non-canonical address range. For the canonical range
1722
* we also need to include the userspace guard page.
1823
*/
19-
return vaddr < TASK_SIZE_MAX + PAGE_SIZE ||
20-
canonical_address(vaddr, boot_cpu_data.x86_virt_bits) != vaddr;
24+
return vaddr >= TASK_SIZE_MAX + PAGE_SIZE &&
25+
canonical_address(vaddr, boot_cpu_data.x86_virt_bits) == vaddr;
2126
}
2227
#else
23-
static __always_inline bool invalid_probe_range(u64 vaddr)
28+
bool probe_kernel_read_allowed(const void *unsafe_src, size_t size, bool strict)
2429
{
25-
return vaddr < TASK_SIZE_MAX;
30+
if (!strict)
31+
return true;
32+
return (unsigned long)unsafe_src >= TASK_SIZE_MAX;
2633
}
2734
#endif
28-
29-
long probe_kernel_read_strict(void *dst, const void *src, size_t size)
30-
{
31-
if (unlikely(invalid_probe_range((unsigned long)src)))
32-
return -EFAULT;
33-
34-
return __probe_kernel_read(dst, src, size);
35-
}
36-
37-
long strncpy_from_kernel_nofault(char *dst, const void *unsafe_addr, long count)
38-
{
39-
if (unlikely(invalid_probe_range((unsigned long)unsafe_addr)))
40-
return -EFAULT;
41-
42-
return __strncpy_from_unsafe(dst, unsafe_addr, count);
43-
}

‎include/linux/uaccess.h‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -301,9 +301,11 @@ copy_struct_from_user(void *dst, size_t ksize, const void __user *src,
301301
return 0;
302302
}
303303

304+
bool probe_kernel_read_allowed(const void *unsafe_src, size_t size,
305+
bool strict);
306+
304307
extern long probe_kernel_read(void *dst, const void *src, size_t size);
305308
extern long probe_kernel_read_strict(void *dst, const void *src, size_t size);
306-
extern long __probe_kernel_read(void *dst, const void *src, size_t size);
307309
extern long probe_user_read(void *dst, const void __user *src, size_t size);
308310

309311
extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
@@ -312,7 +314,7 @@ extern long notrace probe_user_write(void __user *dst, const void *src, size_t s
312314
extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
313315
long strncpy_from_kernel_nofault(char *dst, const void *unsafe_addr,
314316
long count);
315-
extern long __strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
317+
316318
long strncpy_from_user_nofault(char *dst, const void __user *unsafe_addr,
317319
long count);
318320
long strnlen_user_nofault(const void __user *unsafe_addr, long count);

‎mm/maccess.c‎

Lines changed: 37 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,17 @@
66
#include <linux/mm.h>
77
#include <linux/uaccess.h>
88

9+
static long __probe_kernel_read(void *dst, const void *src, size_t size,
10+
bool strict);
11+
static long __strncpy_from_unsafe(char *dst, const void *unsafe_addr,
12+
long count, bool strict);
13+
14+
bool __weak probe_kernel_read_allowed(const void *unsafe_src, size_t size,
15+
bool strict)
16+
{
17+
return true;
18+
}
19+
920
/**
1021
* probe_kernel_read(): safely attempt to read from any location
1122
* @dst: pointer to the buffer that shall take the data
@@ -19,8 +30,11 @@
1930
* DO NOT USE THIS FUNCTION - it is broken on architectures with entirely
2031
* separate kernel and user address spaces, and also a bad idea otherwise.
2132
*/
22-
long __weak probe_kernel_read(void *dst, const void *src, size_t size)
23-
__attribute__((alias("__probe_kernel_read")));
33+
long probe_kernel_read(void *dst, const void *src, size_t size)
34+
{
35+
return __probe_kernel_read(dst, src, size, false);
36+
}
37+
EXPORT_SYMBOL_GPL(probe_kernel_read);
2438

2539
/**
2640
* probe_kernel_read_strict(): safely attempt to read from kernel-space
@@ -36,15 +50,20 @@ long __weak probe_kernel_read(void *dst, const void *src, size_t size)
3650
* probe_kernel_read() suitable for use within regions where the caller
3751
* already holds mmap_lock, or other locks which nest inside mmap_lock.
3852
*/
53+
long probe_kernel_read_strict(void *dst, const void *src, size_t size)
54+
{
55+
return __probe_kernel_read(dst, src, size, true);
56+
}
3957

40-
long __weak probe_kernel_read_strict(void *dst, const void *src, size_t size)
41-
__attribute__((alias("__probe_kernel_read")));
42-
43-
long __probe_kernel_read(void *dst, const void *src, size_t size)
58+
static long __probe_kernel_read(void *dst, const void *src, size_t size,
59+
bool strict)
4460
{
4561
long ret;
4662
mm_segment_t old_fs = get_fs();
4763

64+
if (!probe_kernel_read_allowed(src, size, strict))
65+
return -EFAULT;
66+
4867
set_fs(KERNEL_DS);
4968
pagefault_disable();
5069
ret = __copy_from_user_inatomic(dst, (__force const void __user *)src,
@@ -56,7 +75,6 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
5675
return -EFAULT;
5776
return 0;
5877
}
59-
EXPORT_SYMBOL_GPL(probe_kernel_read);
6078

6179
/**
6280
* probe_user_read(): safely attempt to read from a user-space location
@@ -163,8 +181,10 @@ EXPORT_SYMBOL_GPL(probe_user_write);
163181
* DO NOT USE THIS FUNCTION - it is broken on architectures with entirely
164182
* separate kernel and user address spaces, and also a bad idea otherwise.
165183
*/
166-
long __weak strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count)
167-
__attribute__((alias("__strncpy_from_unsafe")));
184+
long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count)
185+
{
186+
return __strncpy_from_unsafe(dst, unsafe_addr, count, false);
187+
}
168188

169189
/**
170190
* strncpy_from_kernel_nofault: - Copy a NUL terminated string from unsafe
@@ -184,18 +204,22 @@ long __weak strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count)
184204
* If @count is smaller than the length of the string, copies @count-1 bytes,
185205
* sets the last byte of @dst buffer to NUL and returns @count.
186206
*/
187-
long __weak strncpy_from_kernel_nofault(char *dst, const void *unsafe_addr,
188-
long count)
189-
__attribute__((alias("__strncpy_from_unsafe")));
207+
long strncpy_from_kernel_nofault(char *dst, const void *unsafe_addr, long count)
208+
{
209+
return __strncpy_from_unsafe(dst, unsafe_addr, count, true);
210+
}
190211

191-
long __strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count)
212+
static long __strncpy_from_unsafe(char *dst, const void *unsafe_addr,
213+
long count, bool strict)
192214
{
193215
mm_segment_t old_fs = get_fs();
194216
const void *src = unsafe_addr;
195217
long ret;
196218

197219
if (unlikely(count <= 0))
198220
return 0;
221+
if (!probe_kernel_read_allowed(unsafe_addr, count, strict))
222+
return -EFAULT;
199223

200224
set_fs(KERNEL_DS);
201225
pagefault_disable();

0 commit comments

Comments
 (0)