From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S943777AbdEZPle (ORCPT ); Fri, 26 May 2017 11:41:34 -0400 Received: from mail-ve1eur01on0050.outbound.protection.outlook.com ([104.47.1.50]:20025 "EHLO EUR01-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932587AbdEZPlb (ORCPT ); Fri, 26 May 2017 11:41:31 -0400 Authentication-Results: arndb.de; dkim=none (message not signed) header.d=none;arndb.de; dmarc=none action=none header.from=arm.com; Date: Fri, 26 May 2017 16:40:48 +0100 From: Mark Rutland To: Arnd Bergmann CC: Catalin Marinas , the arch/x86 maintainers , Kees Cook , Linux ARM , Linux Kernel Mailing List Subject: Re: arm64 test_user_copy crash on copy_from_user(uptr, kptr, size) Message-ID: <20170526154048.GB22865@leverpostej> References: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Originating-IP: [217.140.96.140] X-ClientProxiedBy: AM5PR04CA0034.eurprd04.prod.outlook.com (2603:10a6:206:1::47) To VI1PR0802MB2399.eurprd08.prod.outlook.com (2603:10a6:800:ba::19) X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI1PR0802MB2399: X-MS-Office365-Filtering-Correlation-Id: b4ad5c70-111c-4075-54c4-08d4a44dac98 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081)(201703131423075)(201703031133081);SRVR:VI1PR0802MB2399; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2399;3:oUn1otr19TGJ8cIzH7+vKIz5RpQ0bZqxQCieudFNKV/V3o9wzrLtplBC7I+NLC8Yj0WSHKWa0godJ/5fWQ4gyiYs14wCPZH/8rziCPhfWyAbGZx3uokrqWFaNkOXY71qremOnb521nV+M957j+ZhZrowfUPHlawUq3TDUDfmlHPs3Hi1pbL2tV0+jqDxcolVjxU48/zevIA1m28rOH1GfVZ5ZZ7n9luzVq/3whz8D08woaP1BTkbs8DOVE6MWBgUUSXDvCkopVcZZ6kvk6uyVovc8/R9QPjEpfTWmDi9rt0MextIHnztb97rxxb9V3fJ8P5tGpCp6Y5V0McTA8m26LopDxJRd3GIfWdm2K3ebFE=;25:qDfDkcZS+/HRpuE0nSbS++LYDilIjwqTgV7zdrAG6tOO4Y7BIqIPv0ZfMzTrwgtt8PEqO9tcA1jgRjJJfq/Wol4pPDZBgv/TsGdjmnABa1DoNqx2DRnP1mtWq5sMrshFVtCYMEBBBLO1xYhCbnFFeaRcF4xmpoU5GRFgoacWPxt02A8+bAgdEjdTn3hWVhwxN/FeZ3mQuK0/Tlrw4VDsS0PGXC6k+uTYlaEShE2LNOE0KwCNbzsJpBPyZRMVmFPz+3sJRqFPE8YPwf+ewqb549pePxFjxjsfDRS/RUR72+rN1e71eVCaAzR0h3zDi4OHGGMiPjTdtvvXwCTUeHEu1G4JQnSGlbIdrlBrjxJZ1EEWLXekMPh19ruSdFmet/sF00d3vo0HdKJXM2LUFl5+BfnlRXMkb34VWs1I+ktFbf+BNLtr9rm7yiNJSLs7kwmyVYHt3dJlhnUDfBFCRzlpp66yYcjyQscV5f0jvdQFxY0= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2399;31:IhskvvW2wYU9X11wWSRoxdDr4XjLosWMlf2fIir0q0tfoG+GEMsf3LMk9fOPF1NpKyp8PCjaBx1qKQ1H8r0HJ9QYudcLSuMeNaDKARuD+IS5Xzmz5/LxAQ6Xpw3XpXLCVkwpbBpVtAwXFMwhwQc7gNscmtFwJi8nrbusrEaxbvGqJjLUl3jdR6C/6194xuo/24tlaQuNRIfQTfEsK0i0+sCJRMVgYby7Y5Wmkprt11E=;20:a876zrfvaM35P40k8tAUg8pRxtb3Exm+g2hGS/GvKOb9NNY+mnMham7Krd5BIWfBgvwAKeSd0r3GZb83DueRvrJZxWAOByLACI6oQTyp1XuWcdA0WDC1uBdjgH98xvzxWOl/tLHcs1K/3IcqGXd4WlLpbJ3FkvpiyKUHPOV8IH3eiJG9BRxTXCNzfqbj53qt1sbDe6oiy6p4K6TpSLH+fFC21zqKHV7gpLjj+dsQ7l313aQkCirYlp1YAvt54BEpFK0r3SDkX/RXMbXUChTgUpATUYuy+/RTHbvISMn1HCp/m8hsLF0hE7td2gVFs0RhsLJx8hDw3PvCT11EcF2oySW9itSAy5vrSUDXWlBYPPrXvmhHRsCXBe1qhUXzUuwDS6zSXxTesHwnfQE0ThQLI73c3X4f/0PGLGqtbNe26416pvUWADfB9sL9Dt8XqiBLiOZdquyntDL12waItB327nsn0aSSseLsjxHZKlpjxxQ3JfwCA25jrBmxh6FCYn9b X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040450)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006095)(93001095)(6055026)(6041248)(20161123564025)(20161123560025)(20161123562025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123558100)(6072148);SRVR:VI1PR0802MB2399;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0802MB2399; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2399;4:sunSXticwTkUqr6lOsdVVLsJqhFV6F9SH33ZtsjX6HaXjG9uKlakXgO4OOvFgXLc5T3unFaWh8qfj62y3Gv3UDqtc8ZI7uD6fuOy1Psnlmh6TVZ6d23QS7vEB+qXVifqe+j+bXxaWx/6X1/G1pMPHoKP+wZSdH/NQnySBpWH+5U3ZblN7NfJZvPdHS4EPKUjeTNkh24YElHc0or3jFbejF0w9GSbvO8hUbfjb3ADcgutm1fc50FGw4UYqHPmywCzwx6V9YsvaFD67mYp6CzdDJiCkrkVUzih9O7SXF7m6pLFIiI2sgpXKI8bPUkYaKc4rh/V37QwmybBWOA8zoR0hs3+GwOMRlol6uuG5kAA+viigf7zUdf9p4Uk62z7sxHmt9wiD6LRolM+nU5WY+twRRn3XMqaJo8B4Kz13+IEbuMkWapjCgqYxM0Z0zbTsmJOQ3KedyMiNPOvLKwNcTeVxKoAcXFMtTWYpCi6YhjU+uapqRrWBN2Nzi0IkokpNKcHfFLOJ9id9mGtyoJLXVcjQTIAeWp/T+ZN2qIi9EGyLzofQKEJnFnXgd6/ucU/sHVfsjAYajBt7SmNCAmtIXwOosA0wgOxuecOniVV7F9Ei1mohFfz0HUTr2kdc81WcH5WLTp37W7ztGISU2GmLAHyRkYXLw84iLu8kanVOItmcYUi76X+7vMKL0hQ4FTu4jTyYxmDeYryhJ9am2PbRfzY8yfq/Qz5+dJn/gnsTp7vCg1+cHn22BRvl9/5uSMoFaY+G4XnB+PkOQzWWdVHPLLzR/knr7GzKvTVTjEgI2UKp78MPlFi0a5r9C6WFPZZ0L3T X-Forefront-PRVS: 031996B7EF X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6009001)(39400400002)(39410400002)(39450400003)(39850400002)(39860400002)(39840400002)(40434004)(24454002)(47776003)(86362001)(97756001)(189998001)(4001350100001)(2906002)(3846002)(42186005)(66066001)(33656002)(23726003)(6116002)(33716001)(1076002)(83506001)(7736002)(305945005)(5660300001)(5890100001)(9686003)(229853002)(6496005)(478600001)(966005)(6666003)(81166006)(4326008)(72206003)(6246003)(50466002)(2950100002)(8676002)(54906002)(6306002)(110136004)(46406003)(25786009)(76176999)(53936002)(54356999)(8746002)(38730400002)(50986999)(6916009)(55016002)(18370500001);DIR:OUT;SFP:1101;SCL:1;SRVR:VI1PR0802MB2399;H:leverpostej;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;VI1PR0802MB2399;23:QCFo1fDlgKBOiPCRyl8U2SmMyuDEDrAILs5St9A?= =?us-ascii?Q?GOF98SAC8upL629YidxxOTZ/usHCcCAnY+0ZAZY+AzuIwjrL+4qJEph7uMIA?= =?us-ascii?Q?/EYFDBpFB6RIRvxOStTbyAex+OhczrlVdCM3iCY26zW+H7JmGpfGM2kWbcAu?= =?us-ascii?Q?boCUcEjT8iS5gt+Iw5UlHwwNmqSCMR3h6IIkUa08Hb2aJY7wUbOEvRmupcb4?= =?us-ascii?Q?M/WlZtAcbGH85gamvlwGfUci/GkKJj0L7ncRFX0B/451S/3VwUH+/S7XH1Vq?= =?us-ascii?Q?JAeB449n9zRtR2PXQ8gg20KH5/Ep7qvHKoMQQEnngUhgdHt4neI2ZYBsNdiv?= =?us-ascii?Q?f7IRRjOg4JuQnmKPB/gwhP68pqDy7lSo+jADj1Yo310ZnhgXIurDT0slsnmb?= =?us-ascii?Q?56YzEXKuQ/Bal8JerNwNWs7IY5KancPfNkdw8mk4JWjEv8vOHOmke15mjKXV?= =?us-ascii?Q?F4vOUh5hhS+nfUJGKGtJoP8QZwmmDUjEVOU4BoZ4Ux7VsrBkpiTCfxyCFnqm?= =?us-ascii?Q?PAqwLESzfaMR9VQW9NBme67x4ySqYwpZ0/DOOE/VwPoRRYaC44E0bZTESqks?= =?us-ascii?Q?18OMAlDjzKdnYPsN/g7fjZWx4jko5fAMcpQtfPwypFoX8CgAytn3+1KokvRf?= =?us-ascii?Q?sHDdV+kphfdEcb9Wg/O5bQxtFu+mrwN4wq/N4eUThilXEJeuERt4U7uT4os+?= =?us-ascii?Q?pl8F2YU6ldHmE+xhz4EAuLhar14xFxiXS1A7aIziZfJiePQFppnv8Z4JuD/e?= =?us-ascii?Q?xU9IOD5/NnQkR2XINSQ3/Ro/7JLSfr76ewZ0BIgtd58f63LMAkzgkvNF9xZi?= =?us-ascii?Q?epcqepuAY8uKTvWjZCqdMkBy+GWZagp8M4OzmhL01CiLWERQARWSap7ZEin7?= =?us-ascii?Q?kDwdhbzjpPj71v8xQZNGtXaygq6VS4ZGnHftNx9qKvRem8rvgAvcLBvrMGPu?= =?us-ascii?Q?SeFP+wFtkOBQU7BUYVcoxe59s57wFGUilgGPk1HYVnXPqgG7YtqJ98PmRn/G?= =?us-ascii?Q?WmKBLUNaY19mZVWBobhJnu4zSX8GqEQUkjaJ+1jArrwcZxC7tfo+uU1jLMA1?= =?us-ascii?Q?hl5IRd8weLy7wMgi+2z8wdznXSY8sgzgMqBegDT9zU/p85G0U2+zD3xWme4u?= =?us-ascii?Q?a134GrXzTifkVheAQ/LPE/7bXp+KOqTyz0FSxXsiVwb4pUUt+/payj1c+ebd?= =?us-ascii?Q?Kqf1pfL8B6vXx7y0/5YfYi5mVgkI5rdLXLHnfXAcj45e3oGlydhXhcbbTT47?= =?us-ascii?Q?RfKMTvku8DnfJQz8aktrFMWk83HSo+HN8k1o8jr0vS2pjJ13fJ5EEI8f4IH/?= =?us-ascii?Q?Crp8ax9/jXNJXlaIzhdtCbNfXLQL9VfvrYHGR+DPNT5mWSzvGylLHMY1lE9s?= =?us-ascii?Q?x5piXcVw3fXUK0H8zoHnoVf2IHxo=3D?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2399;6:ZwH0L0KFgf2/UVBd5Adb7UhGK8qRgWIKW9iyTqEwYVOJa5+hsLodYbcebQU+5e/y+fJgPm6NwZbpisb6g9xOu/nt2myLHPts11NQgQRm9wJGEVw/52Pc3jW8yFc1CcnQRZ5NQGy6kc/hqFq5rrn6fIi7wQZzOgI0DU0gfW24bBFoZUnOhtY/n9ySpK+aEnEhynWvqpcWt3jaFBKUQdJ0htJVms9MReS+Cb9kx628ovhbH7x9T2od7oDWidbiRM1s2mWakCsyBnjeXLhNWZqttYNkSdZoTp9n9vqDaRq9aWoxN7HqsrtBv7flaoqRWYd3yp7LNIFgeV9DK7G8ZVKpxh9tCu+LzXlw1FYBAI13BcEownIeN3YOFvQWKygExIzrA8QxAH7T8F4vFQlcGkSgninYj6rKCeTsZYEPz6X4gTw0157kNU41EYdycx6aDfGHe9dusuTwz/+6ZkZqK5Od9Y5oNiRIomLQ7qq70kQ4ZRMuXHU68zilCUrj/D6CMr0n3xbnGRBGHU7kJP7fiwTLgksDQRnj9/VXcJVqaH0xvO0=;5:A/Q13qPs7MMYWHewCkAXX+IrmW04iVQ7Nah8zxlsG3thg51x4XFy7LExvWcItQMMCsPrk4zOgr8UKSBKRWFeE1VZ5wicy8wvaVJ3smgGaCzr820srfc7Xi6am5oBG2QFIrQvV0S4KAMZY7eXcV6Kvg==;24:c5WwHoenn6UxwfmK7qDxQwsCibYpRIBH6r+pgCq0Gw6YhQp+Me+0svZowDT5CCqfQ6VO44vTGjHdpwIf95uuFAgzVHViTNQYFl1KsM8WSNA= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2399;7:SxGAqLaPbIqTL9aj1pMUiiQ/HSrydH7CCdTUvHm5z8PhfBZAirSqVPde+phRezDqAOaZzp2JqVN/KiwICInGzZju30OOv4ogPkp9z+Jrr7Ew+LRDvYMT1ywayX450gtQUordOkGUJJbvWBIqEUoBp68DTmQTNXX2cQFMt0cMNYM3+Ox2g92toAQgc3eVOLI6mrYpQf3tdBoxTrNKy1t+f34uDzMMNF0AtsRFs9UugB7G4epgLg8sEsjcbZtF/Wjc1Xe+x1oetrrqLEfCBe0rVcmtJNvfY8qMLtxbhOaaPVpGWikKjMzd5RDsgBb/H8bRwAOHPyeIVyxJtBmHFV1xqQ== X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 May 2017 15:41:27.4621 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0802MB2399 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id v4QFhA3t025125 On Fri, May 26, 2017 at 05:24:47PM +0200, Arnd Bergmann wrote: > A kselftest run on arm64 on an older 4.4.y stable kernel ran into an > unexpectedly trapping user space access: > > [ 1277.857738] Internal error: Accessing user space memory outside > uaccess.h routines: 96000045 [#1] PREEMPT SMP > > Apparently the same thing happens on x86 as well, and it still happens on > the latest kernels, see https://bugs.linaro.org/show_bug.cgi?id=3011 > > The problem here is this test > > ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, > PAGE_SIZE), > "illegal reversed copy_from_user passed"); > > where the destination kernel pointer intentionally points into user space > memory, while copy_from_user checks the second argument for being > a valid user space, which it also is not.: > > static inline unsigned long __must_check copy_from_user(void *to, > const void __user *from, unsigned long n) > { > unsigned long res = n; > kasan_check_write(to, n); > > if (access_ok(VERIFY_READ, from, n)) { > check_object_size(to, n, false); > res = __arch_copy_from_user(to, from, n); > } > if (unlikely(res)) > memset(to + (n - res), 0, res); > return res; > } > > The memset here will now try to clear user space data, and the > architecture notices that the fault did not come from a proper > uaccess function. > > I think this will only happen when CONFIG_ARM64_PAN, > X86_SMAP or an equivalent feature on another architecture is > enabled, otherwise we just do the access anyway. I don't have > a good idea for avoiding the problem though, other than > removing the specific test that causes it. AFAICT, that test was disabled in commit: f5f893c57e37ca73 ("usercopy: Adjust tests to deal with SMAP/PAN") ... or have I misunderstood? Thanks, Mark. IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.