From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06304C49EA5 for ; Thu, 24 Jun 2021 16:18:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D02B1613C0 for ; Thu, 24 Jun 2021 16:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229940AbhFXQUr (ORCPT ); Thu, 24 Jun 2021 12:20:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41176 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229525AbhFXQUq (ORCPT ); Thu, 24 Jun 2021 12:20:46 -0400 Received: from zeniv-ca.linux.org.uk (zeniv-ca.linux.org.uk [IPv6:2607:5300:60:148a::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1CDDEC061574 for ; Thu, 24 Jun 2021 09:18:26 -0700 (PDT) Received: from viro by zeniv-ca.linux.org.uk with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1lwS37-00Br5k-1Q; Thu, 24 Jun 2021 16:17:53 +0000 Date: Thu, 24 Jun 2021 16:17:53 +0000 From: Al Viro To: Catalin Marinas Cc: Matthew Wilcox , Christoph Hellwig , Chen Huang , Mark Rutland , Andrew Morton , Stephen Rothwell , Randy Dunlap , Will Deacon , Linux ARM , linux-mm , open list Subject: Re: [BUG] arm64: an infinite loop in generic_perform_write() Message-ID: References: <20210623132223.GA96264@C02TD0UTHF1T.local> <1c635945-fb25-8871-7b34-f475f75b2caf@huawei.com> <20210624150911.GA25097@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210624150911.GA25097@arm.com> Sender: Al Viro Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jun 24, 2021 at 04:09:11PM +0100, Catalin Marinas wrote: > On Thu, Jun 24, 2021 at 12:15:46PM +0100, Matthew Wilcox wrote: > > On Thu, Jun 24, 2021 at 08:04:07AM +0100, Christoph Hellwig wrote: > > > On Thu, Jun 24, 2021 at 04:24:46AM +0100, Matthew Wilcox wrote: > > > > On Thu, Jun 24, 2021 at 11:10:41AM +0800, Chen Huang wrote: > > > > > In userspace, I perform such operation: > > > > > > > > > > fd = open("/tmp/test", O_RDWR | O_SYNC); > > > > > access_address = (char *)mmap(NULL, uio_size, PROT_READ, MAP_SHARED, uio_fd, 0); > > > > > ret = write(fd, access_address + 2, sizeof(long)); > > > > > > > > ... you know that accessing this at unaligned offsets isn't going to > > > > work. It's completely meaningless. Why are you trying to do it? > > > > > > We still should not cause an infinite loop in kernel space due to a > > > a userspace programmer error. > > > > They're running as root and they've mapped some device memory. We can't > > save them from themself. Imagine if they'd done this to the NVMe BAR. > We could change raw_copy_from_user() to fall back to 1-byte read in case > of a fault or fix this corner case in the generic code. A quick hack, > re-attempting the access with one byte: No. If nothing else, iov_iter_single_seg_count() is a bad kludge. What's more, this "do a single-byte copy" fallback is punishing a much more common case (memory pressure evicting the page) for the sake of a corner case specific to one architecture that should've been dealt with in its raw_copy_from_user(). NAKed-by: Al Viro For some context, see include/linux/uaccess.h and description of requirements for raw_copy_from_user() in there.