Forum | Documentation | Website | Blog

Skip to content
Snippets Groups Projects
  • Alexei Starovoitov's avatar
    mm: Fix copy_from_user_nofault(). · d319f344
    Alexei Starovoitov authored
    
    There are several issues with copy_from_user_nofault():
    
    - access_ok() is designed for user context only and for that reason
    it has WARN_ON_IN_IRQ() which triggers when bpf, kprobe, eprobe
    and perf on ppc are calling it from irq.
    
    - it's missing nmi_uaccess_okay() which is a nop on all architectures
    except x86 where it's required.
    The comment in arch/x86/mm/tlb.c explains the details why it's necessary.
    Calling copy_from_user_nofault() from bpf, [ke]probe without this check is not safe.
    
    - __copy_from_user_inatomic() under CONFIG_HARDENED_USERCOPY is calling
    check_object_size()->__check_object_size()->check_heap_object()->find_vmap_area()->spin_lock()
    which is not safe to do from bpf, [ke]probe and perf due to potential deadlock.
    
    Fix all three issues. At the end the copy_from_user_nofault() becomes
    equivalent to copy_from_user_nmi() from safety point of view with
    a difference in the return value.
    
    Reported-by: default avatarHsin-Wei Hung <hsinweih@uci.edu>
    Signed-off-by: Alexei Starov...
    d319f344