Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-28 Thread Rik van Riel
On Mon, 2018-08-27 at 19:10 -0700, Andy Lutomirski wrote: > On Mon, Aug 27, 2018 at 6:31 PM, Rik van Riel > wrote: > > > What is special about this path wrt nmi_uaccess_ok that is > > not also true for the need_flush branch right above it? > > > > What am I missing? > > Nothing. My patch is

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-28 Thread Rik van Riel
On Mon, 2018-08-27 at 19:10 -0700, Andy Lutomirski wrote: > On Mon, Aug 27, 2018 at 6:31 PM, Rik van Riel > wrote: > > > What is special about this path wrt nmi_uaccess_ok that is > > not also true for the need_flush branch right above it? > > > > What am I missing? > > Nothing. My patch is

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Andy Lutomirski
On Mon, Aug 27, 2018 at 6:31 PM, Rik van Riel wrote: > On Mon, 2018-08-27 at 16:04 -0700, Andy Lutomirski wrote: > >> +++ b/arch/x86/mm/tlb.c >> @@ -345,6 +345,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, >> struct mm_struct *next, >>*/ >>

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Andy Lutomirski
On Mon, Aug 27, 2018 at 6:31 PM, Rik van Riel wrote: > On Mon, 2018-08-27 at 16:04 -0700, Andy Lutomirski wrote: > >> +++ b/arch/x86/mm/tlb.c >> @@ -345,6 +345,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, >> struct mm_struct *next, >>*/ >>

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Rik van Riel
On Mon, 2018-08-27 at 16:04 -0700, Andy Lutomirski wrote: > +++ b/arch/x86/mm/tlb.c > @@ -345,6 +345,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, > struct mm_struct *next, >*/ > trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, > TLB_FLUSH_ALL); > }

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Rik van Riel
On Mon, 2018-08-27 at 16:04 -0700, Andy Lutomirski wrote: > +++ b/arch/x86/mm/tlb.c > @@ -345,6 +345,9 @@ void switch_mm_irqs_off(struct mm_struct *prev, > struct mm_struct *next, >*/ > trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, > TLB_FLUSH_ALL); > }

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Jann Horn
On Tue, Aug 28, 2018 at 1:26 AM Andy Lutomirski wrote: > > On Mon, Aug 27, 2018 at 4:12 PM, Jann Horn wrote: > > On Tue, Aug 28, 2018 at 1:04 AM Andy Lutomirski wrote: > >> > >> In NMI context, we might be in the middle of context switching or in > >> the middle of switch_mm_irqs_off(). In

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Jann Horn
On Tue, Aug 28, 2018 at 1:26 AM Andy Lutomirski wrote: > > On Mon, Aug 27, 2018 at 4:12 PM, Jann Horn wrote: > > On Tue, Aug 28, 2018 at 1:04 AM Andy Lutomirski wrote: > >> > >> In NMI context, we might be in the middle of context switching or in > >> the middle of switch_mm_irqs_off(). In

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Andy Lutomirski
On Mon, Aug 27, 2018 at 4:12 PM, Jann Horn wrote: > On Tue, Aug 28, 2018 at 1:04 AM Andy Lutomirski wrote: >> >> In NMI context, we might be in the middle of context switching or in >> the middle of switch_mm_irqs_off(). In either case, CR3 might not >> match current->mm, which could cause

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Andy Lutomirski
On Mon, Aug 27, 2018 at 4:12 PM, Jann Horn wrote: > On Tue, Aug 28, 2018 at 1:04 AM Andy Lutomirski wrote: >> >> In NMI context, we might be in the middle of context switching or in >> the middle of switch_mm_irqs_off(). In either case, CR3 might not >> match current->mm, which could cause

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Jann Horn
On Tue, Aug 28, 2018 at 1:04 AM Andy Lutomirski wrote: > > In NMI context, we might be in the middle of context switching or in > the middle of switch_mm_irqs_off(). In either case, CR3 might not > match current->mm, which could cause copy_from_user_nmi() and > friends to read the wrong memory.

Re: [PATCH] x86/nmi: Fix some races in NMI uaccess

2018-08-27 Thread Jann Horn
On Tue, Aug 28, 2018 at 1:04 AM Andy Lutomirski wrote: > > In NMI context, we might be in the middle of context switching or in > the middle of switch_mm_irqs_off(). In either case, CR3 might not > match current->mm, which could cause copy_from_user_nmi() and > friends to read the wrong memory.