On Tue, Sep 20, 2016 at 12:07 PM, Al Viro <v...@zeniv.linux.org.uk> wrote:
> Switching iov_iter fault-in to multipages variants has exposed an old
> bug in underlying fault_in_multipages_...(); they break if the range
> passed to them wraps around. Normally access_ok() done by callers
> will prevent such (and it's a guaranteed EFAULT - ERR_PTR() values
> fall into such a range and they should not point to any valid objects).
> However, on architectures where userland and kernel live in different
> MMU contexts (e.g. s390) access_ok() is a no-op and on those a range
> with a wraparound can reach fault_in_multipages_...().
Quite frankly, I think it is access_ok() that should be fixed for s390.
A wrapping user access is *not* ok, not even if kernel and user memory
are separate.
It is insane to make fault_in_multipages..() return EFAULT if a normal
wrapping user access wouldn't. So the fix is not to change
fault_in_multipage_xyz, but to make sure any op that tries to wrap
will properly return EFAULT.
So I really think that we should just say "a no-op access_ok() is a
buggy access_ok()", and fix the problem at the source, rather than
make excuses for it in some random place.
A quick look seems to say that s390 and no-mmu ARM are the only
affected cases, but maybe I missed something.
Linus
