From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.214.200 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793051575; b=5icona9daMYuyWQlQyc0KLNdaZuNNcjHc2WOS3KJDlzV88aCJKxjB/sKP9PQYPHl16cz TlTmeRTxWJ+gv9C9k9YvVxMayWeaBmKvjV8j/ubUwzelc9muAurHygSp8HsaKkSOBKMN5 0ECE/6I2fnothOlxOLkpaoZgBVTogyvKgE3IWdIgjUChKN5Y+Mk1OaN3wsOxl6cBur/w7 +YjGQRaxheSPou5dkpVHjOJyLJo2Bj3yJxasLgG0H9+DQzS7ApFZ4MuIDEJnU6r6C/iYR HLYac/DNO5pqnPfyk+kxyOW9INq+5Jr3PTbXW+f0YXsYIg6h80N4y09//GnAls5yOUA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793051575; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=bFIgocNkSNISRV4CHBI3t0UD1tr56XsmI6e/PuL6mFQ=; b=J40AZhVZ1Hxh4GYP/b9Lb7gFW3fjkz+7wi65I5UJC/Wl+eC/An/81NSU2hiHne1DDHgx MZMqbdCYkrnDcRDYIT35w6vmVbapbH/jpi2TxJSiNRA/2o9fbCaVj3uyYa5292XZeLlS/ 8rXV0nMJ+jkttQjMF9RY6mf8V1LkkhUjv1okXCRv0Uqk343awtXb6iKMlpsUI5niyldHO GDVMEr8r+Hgtn4YN3yEKIF1gh1lw98L87GhenEn8qZiobgXCXMb3ps/aHnXAGiya+uTAR truiJjI6XdYjr5xjASpDfZa4XlAokgDtsXbpc1qyayVhyzkzPBSmSYUM0mfJq2+LA4A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--jthoughton.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b="HZDE5/h8"; arc=none smtp.remote-ip=209.85.214.200 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7BEE5606AB0F for ; Mon, 26 Oct 2026 21:52:55 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 7BEE5606AB0F Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--jthoughton.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=HZDE5/h8 Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2eaae8d29e0so17429465ad.2 for ; Mon, 26 Oct 2026 14:52:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1793051575; x=1793656375; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=bFIgocNkSNISRV4CHBI3t0UD1tr56XsmI6e/PuL6mFQ=; b=HZDE5/h8w3OLnXIxK6aJgBJe5iwYfPAwmjEpbW/4ftuyFH9ujuIrSw0dznV9OUyE6F vLLrtdw5C1f/2X+KE5a5AjTR0OVlTErAcMYLlhQ5t2W88/kgSbZ50jbWTAgaZjq8AYcS 4LLCa+on0oJ7TLoL82cJ6x9U3nUI29G0f4PX+yu671qzXzwpuN6+UwWx7JShwc/LkLfM GRw34cZFEGEcFhzeutRJqBfkALCNUgi6P0+zbacA4vpG0KwtbVgvsMdzT9Ez5Kd0LgzS r7YDxe2JSHaiPCcL0fARduZEtNb5N686qJeDu/bTRdIxd0MlXDFjjdccfXbzfnsu4WZc oRRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793051575; x=1793656375; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bFIgocNkSNISRV4CHBI3t0UD1tr56XsmI6e/PuL6mFQ=; b=2i/y4ANnj1ZsoQYuWeGB26qBHbaUTdIX/FUk2bql812AivI2mgztj4mPKyVLSZJRtN 32ox2jFbUxQXmegzR1Ie2HUdUFN7/z2ZgpUcAef01PF41fP1IwYe3N+hXFp3efDalL4d Dj4QlKGtCFqphkfioPrwWSlps6uQ0BRZgFC7kzseqKC7+DLm+2kHCX680jF8YJa6DUSQ Tr7LJk2EUeQZsXQOGtieqSOjxN6/4eAuVkjRUIxU7QfAhlvk9CsRZfqX8NfGgRZqcYgA 4K6iFghFFRZmHjvbNgmnzBFoCI5X63JXAbemW0rXMNVU5fVBUFxb39+eKMWxJdFFYnkt 7Zwg== X-Forwarded-Encrypted: i=1; AKwUvBxtS8MxoFbvhLJIZi81+Xy6v4VwR4O+29EEy3zXPQJUvo84e+EQ1xMss8LvPWW/mmV4RU/PjnbciaOAo9k=@vger.kernel.org X-Gm-Message-State: AFq9FYIcz+gPPNnaodLr23Asjoh0mv0PKO1qFyBoOxJrAUP+I78YI50o MTOsjrhbKK7dO8lNHHLrXe9YeYxsC2gOf2E4Yx+LLzcwQRX4majCviqyXLjhqsUC5iPLu04tgRj RaARI9Ci6KQ+e3Xlx1JoZMA== X-Received: from plblg15.prod.google.com ([2002:a17:902:fb8f:b0:2e5:712c:5c7]) (user=jthoughton job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:ebc8:b0:2e2:e0f8:e57c with SMTP id d9443c01a7336-2ea9c95ba58mr63848015ad.70.1793051574627; Mon, 26 Oct 2026 14:52:54 -0700 (PDT) Date: Mon, 26 Oct 2026 21:52:24 +0000 In-Reply-To: <20261026215226.3713941-1-jthoughton@google.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261026215226.3713941-1-jthoughton@google.com> X-Mailer: git-send-email 2.56.0.307.g5fe7bd680c-goog Message-ID: <20261026215226.3713941-9-jthoughton@google.com> Subject: [RFC PATCH 08/10] uaccess: Refuse and warn on __copy_from_user_inatomic() without an mm From: James Houghton To: Andrew Morton , Alexander Viro Cc: Thomas Gleixner , Peter Zijlstra , Kees Cook , Arnd Bergmann , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Sean Christopherson , Paolo Bonzini , Jim Mattson , Jens Axboe , Pavel Begunkov , "James E.J. Bottomley" , "Martin K. Petersen" , David Sterba , Chris Mason , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Josh Poimboeuf , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, kvm@vger.kernel.org, io-uring@vger.kernel.org, linux-scsi@vger.kernel.org, linux-btrfs@vger.kernel.org, bpf@vger.kernel.org, linux-trace-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, James Houghton Content-Type: text/plain; charset="UTF-8" __copy_from_user_inatomic() never called should_fail_usercopy(), so the NULL current->mm check added to uaccess_should_fail() does not cover it. It is used e.g. by KVM's kvm_read_guest_atomic(), by several architectures' perf callchain and stack trace code, and by the generic copy_from_user_inatomic_nontemporal(). Split the NULL mm check out of uaccess_should_fail() into uaccess_without_mm(), and use it in __copy_from_user_inatomic() to warn and refuse the copy. Don't use uaccess_should_fail() there, as that would also start injecting failures into __copy_from_user_inatomic(), which some callers don't expect to fail in practice, e.g. __wp_page_copy_user() warns if the copy fails twice. copy_from_user_nofault() already fails quietly when current->mm is NULL, and the generic user stack unwinding entry points (perf_callchain(), get_perf_callchain() and stack_trace_save_user()) only unwind the user stack of a user task with an mm, so neither is affected. Signed-off-by: James Houghton --- include/linux/uaccess.h | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 8ab24e706a22..eae204f7261b 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -51,20 +51,33 @@ #endif /* - * Return true if a user copy must not be attempted, either because a failure - * is being injected, or because the current task has no mm. + * Return true, and warn, if the current task has no mm, in which case user + * memory must not be accessed. * * Accessing user memory without an mm (e.g. from a kernel thread that is not * using kthread_use_mm(), or from a task that has already gone through * exit_mm()) is always a bug: the user portion of the address space belongs to * whatever mm happens to be lazily loaded, if any, so the access could * silently hit another task's memory. + * + * Note that this only catches a missing mm. It cannot catch a valid mm that + * isn't the one the caller expects, e.g. when a file's release or ioctl + * handlers run in a different process than the one that created it. Code + * that keeps user addresses belonging to a specific mm must check + * current->mm against that mm itself (see e.g. KVM's kvm->mm checks). + */ +static __always_inline bool uaccess_without_mm(void) +{ + return WARN_ON_ONCE(!current->mm); +} + +/* + * Return true if a user copy must not be attempted, either because the + * current task has no mm, or because a failure is being injected. */ static __always_inline bool uaccess_should_fail(void) { - if (WARN_ON_ONCE(!current->mm)) - return true; - return should_fail_usercopy(); + return uaccess_without_mm() || should_fail_usercopy(); } /* @@ -117,6 +130,8 @@ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n) { unsigned long res; + if (uaccess_without_mm()) + return n; instrument_copy_from_user_before(to, from, n); check_object_size(to, n, false); res = raw_copy_from_user(to, from, n); -- 2.56.0.307.g5fe7bd680c-goog