Re: [PATCH] Fix compat regression in process_vm_rw()
On 10/27/20 1:19 PM, damian wrote: > On Mo, 26. Okt 18:03, Jens Axboe wrote: >> The removal of compat_process_vm_{readv,writev} didn't change >> process_vm_rw(), which always assumes it's not doing a compat syscall. >> Instead of passing in 'false' unconditionally for 'compat', make it >> conditional on in_compat_syscall(). >> >> Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}") >> Reported-by: Kyle Huey >> Signed-off-by: Jens Axboe >> >> --- >> >> diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c >> index fd12da80b6f2..05676722d9cd 100644 >> --- a/mm/process_vm_access.c >> +++ b/mm/process_vm_access.c >> @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid, >> return rc; >> if (!iov_iter_count()) >> goto free_iov_l; >> -iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, false); >> +iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, >> +in_compat_syscall()); >> if (IS_ERR(iov_r)) { >> rc = PTR_ERR(iov_r); >> goto free_iov_l; >> >> -- >> Jens Axboe >> > Hello Jens, > > i got the following error when i try to build. > > m/process_vm_access.c: In Funktion »process_vm_rw«: > mm/process_vm_access.c:277:5: Fehler: Implizite Deklaration der Funktion > »in_compat_syscall«; meinten Sie »in_ia32_syscall«? > [-Werror=implicit-function-declaration] > 277 | in_compat_syscall()); > | ^ > | in_ia32_syscall Yeah, sorry about that. Geert sent out a fix: https://lore.kernel.org/lkml/20201027182246.651908-1-geert+rene...@glider.be/ -- Jens Axboe
Re: [PATCH] Fix compat regression in process_vm_rw()
On Wed, 28 Oct 2020 at 00:49, damian wrote: > > On Mo, 26. Okt 18:03, Jens Axboe wrote: > > The removal of compat_process_vm_{readv,writev} didn't change > > process_vm_rw(), which always assumes it's not doing a compat syscall. > > Instead of passing in 'false' unconditionally for 'compat', make it > > conditional on in_compat_syscall(). > > > > Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}") > > Reported-by: Kyle Huey > > Signed-off-by: Jens Axboe > > > > --- > > > > diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c > > index fd12da80b6f2..05676722d9cd 100644 > > --- a/mm/process_vm_access.c > > +++ b/mm/process_vm_access.c > > @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid, > > return rc; > > if (!iov_iter_count()) > > goto free_iov_l; > > - iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, > > false); > > + iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, > > + in_compat_syscall()); > > if (IS_ERR(iov_r)) { > > rc = PTR_ERR(iov_r); > > goto free_iov_l; > > > > -- > > Jens Axboe > > > Hello Jens, > > i got the following error when i try to build. > > m/process_vm_access.c: In Funktion »process_vm_rw«: > mm/process_vm_access.c:277:5: Fehler: Implizite Deklaration der Funktion > »in_compat_syscall«; meinten Sie »in_ia32_syscall«? > [-Werror=implicit-function-declaration] > 277 | in_compat_syscall()); > | ^ > | in_ia32_syscall > I have also noticed this build failure on Linus's mainline master branch. x86_64 : FAILED i386: FAILED arm: FAILED make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=x86 HOSTCC=gcc CC="sccache gcc" O=build 50../mm/process_vm_access.c: In function ‘process_vm_rw’: 51../mm/process_vm_access.c:277:5: error: implicit declaration of function ‘in_compat_syscall’; did you mean ‘in_ia32_syscall’? [-Werror=implicit-function-declaration] 52 277 | in_compat_syscall()); 53 | ^ 54 | in_ia32_syscall 55cc1: some warnings being treated as errors Reported-by: Naresh Kamboju full test build log: https://gitlab.com/Linaro/lkft/mirrors/torvalds/linux-mainline/-/jobs/815202967 -- Linaro LKFT https://lkft.linaro.org
Re: [PATCH] Fix compat regression in process_vm_rw()
On Mo, 26. Okt 18:03, Jens Axboe wrote: > The removal of compat_process_vm_{readv,writev} didn't change > process_vm_rw(), which always assumes it's not doing a compat syscall. > Instead of passing in 'false' unconditionally for 'compat', make it > conditional on in_compat_syscall(). > > Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}") > Reported-by: Kyle Huey > Signed-off-by: Jens Axboe > > --- > > diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c > index fd12da80b6f2..05676722d9cd 100644 > --- a/mm/process_vm_access.c > +++ b/mm/process_vm_access.c > @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid, > return rc; > if (!iov_iter_count()) > goto free_iov_l; > - iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, false); > + iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, > + in_compat_syscall()); > if (IS_ERR(iov_r)) { > rc = PTR_ERR(iov_r); > goto free_iov_l; > > -- > Jens Axboe > Hello Jens, i got the following error when i try to build. m/process_vm_access.c: In Funktion »process_vm_rw«: mm/process_vm_access.c:277:5: Fehler: Implizite Deklaration der Funktion »in_compat_syscall«; meinten Sie »in_ia32_syscall«? [-Werror=implicit-function-declaration] 277 | in_compat_syscall()); | ^ | in_ia32_syscall -- VG Damian Tometzki
Re: [PATCH] Fix compat regression in process_vm_rw()
On Tue, Oct 27, 2020 at 1:01 AM Christoph Hellwig wrote: > > Independent of this fix I think we just need to explicitly prohibit > cross-access. Well, prohibiting a 32-bit process from accessing a 64-bit one might make sense, since it fundamentally cannot work, and returning an explicit error early might help avoid confusion. But a 64-bit one can certainly validly look at a 32-bit one (ie debugging a compat process from a 64-bit gdb or similar is not unreasonable). That said, I wonder how muich of a problem that can be, so it may be sufficient to just fix this compat case up and leave it alone. So applied, Linus
Re: [PATCH] Fix compat regression in process_vm_rw()
On Tue, Oct 27, 2020 at 12:09:20AM +, Al Viro wrote: > On Mon, Oct 26, 2020 at 06:03:18PM -0600, Jens Axboe wrote: > > The removal of compat_process_vm_{readv,writev} didn't change > > process_vm_rw(), which always assumes it's not doing a compat syscall. > > Instead of passing in 'false' unconditionally for 'compat', make it > > conditional on in_compat_syscall(). > > > > Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}") > > Reported-by: Kyle Huey > > Signed-off-by: Jens Axboe > > ACK with some reservations - I suspect that we want an explicit flag > for process_vm_{read,write}v() that would force the 64bit layout for > the vector refering to the foreign process. It's not relevant for > regression fix; however, as it is these syscalls are not usable for > 32bit process trying to access memory of 64bit one - there's no way > to specify the addresses past 4G. Independent of this fix I think we just need to explicitly prohibit cross-access.
Re: [PATCH] Fix compat regression in process_vm_rw()
Looks good, Reviewed-by: Christoph Hellwig
Re: [PATCH] Fix compat regression in process_vm_rw()
On Mon, Oct 26, 2020 at 5:03 PM Jens Axboe wrote: > > The removal of compat_process_vm_{readv,writev} didn't change > process_vm_rw(), which always assumes it's not doing a compat syscall. > Instead of passing in 'false' unconditionally for 'compat', make it > conditional on in_compat_syscall(). > > Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}") > Reported-by: Kyle Huey > Signed-off-by: Jens Axboe > > --- > > diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c > index fd12da80b6f2..05676722d9cd 100644 > --- a/mm/process_vm_access.c > +++ b/mm/process_vm_access.c > @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid, > return rc; > if (!iov_iter_count()) > goto free_iov_l; > - iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, > false); > + iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, > + in_compat_syscall()); > if (IS_ERR(iov_r)) { > rc = PTR_ERR(iov_r); > goto free_iov_l; > > -- > Jens Axboe > I tested this patch and it does fix the original testcase I reported. - Kyle
Re: [PATCH] Fix compat regression in process_vm_rw()
On Mon, Oct 26, 2020 at 06:03:18PM -0600, Jens Axboe wrote: > The removal of compat_process_vm_{readv,writev} didn't change > process_vm_rw(), which always assumes it's not doing a compat syscall. > Instead of passing in 'false' unconditionally for 'compat', make it > conditional on in_compat_syscall(). > > Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}") > Reported-by: Kyle Huey > Signed-off-by: Jens Axboe ACK with some reservations - I suspect that we want an explicit flag for process_vm_{read,write}v() that would force the 64bit layout for the vector refering to the foreign process. It's not relevant for regression fix; however, as it is these syscalls are not usable for 32bit process trying to access memory of 64bit one - there's no way to specify the addresses past 4G.
[PATCH] Fix compat regression in process_vm_rw()
The removal of compat_process_vm_{readv,writev} didn't change process_vm_rw(), which always assumes it's not doing a compat syscall. Instead of passing in 'false' unconditionally for 'compat', make it conditional on in_compat_syscall(). Fixes: c3973b401ef2 ("mm: remove compat_process_vm_{readv,writev}") Reported-by: Kyle Huey Signed-off-by: Jens Axboe --- diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c index fd12da80b6f2..05676722d9cd 100644 --- a/mm/process_vm_access.c +++ b/mm/process_vm_access.c @@ -273,7 +273,8 @@ static ssize_t process_vm_rw(pid_t pid, return rc; if (!iov_iter_count()) goto free_iov_l; - iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, false); + iov_r = iovec_from_user(rvec, riovcnt, UIO_FASTIOV, iovstack_r, + in_compat_syscall()); if (IS_ERR(iov_r)) { rc = PTR_ERR(iov_r); goto free_iov_l; -- Jens Axboe