From: James Hogan <james.hogan@xxxxxxxxxx> Date: Tue, 11 Aug 2015 12:07:20 +0100 > Out of interest, is the zeroing a strict requirement for correct use, or > a safety precaution to prevent data leakage in case of bad error checking? > > (A quick look reveals that for copy_from_user() when access_ok() fails, > only arm, arm64, frv, m32r, m68k, sparc, tile, x86, and xtensa do this). It is required, otherwise the kernel buffer is left partially initialized which can lead to security bugs. > That's a good point. The reversed tests aren't really safe in that case. > With MIPS EVA the user address is very likely to be a valid > non-TLB-mapped address to kernel mode, and will zero arbitrary memory. > They could also potentially crash the kernel if user memory isn't > normally kernel accessible and the arch doesn't fix up faults for the > kernel accesses (not EVA, but maybe sparc64?). Sparc64 would fault on an invalid kernel address, but the problem here is that the addresses are actually valid kernel ones. > It is also possible (though less likely) that the kernel address will > have a valid user mapping at the same address, so the reversed > copy_to_user test may well leak arbitrary kernel memory to user memory > without faulting. Yes, this is also a problem. >> Also, I think the tests you added and protected with MIPS ifdefs could >> equally be enabled on sparc64. > > Yes, it sounds like it. I'll try the ARCH_SPLIT_VA_SPACE idea. Great! -- To unsubscribe from this list: send the line "unsubscribe linux-arch" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
