On Fri, Feb 03, 2017 at 10:29:23AM -0800, Linus Torvalds wrote: > On Thu, Feb 2, 2017 at 11:29 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote: > > > > get_user_pages() relies upon find_extend_vma() to reject kernel > > addresses; the fast side of get_user_pages_fast() doesn't have anything > > of that sort > > It is *supposed* to have it. > > See pte_allows_gup(), for example. In particular, it requires the > _PAGE_USER bit in the PTE (and the devpte case should require > _PAGE_BIT_DEVMAP). On x86 it does. I don't see anything equivalent in mm/gup.c one, and the only kinda-sorta similar thing (access_ok() in __get_user_pages_fast() there) is vulnerable to e.g. access via kernel_write(). The comment in there * Before activating this code, please be aware that the following assumptions * are currently made: * * *) HAVE_RCU_TABLE_FREE is enabled, and tlb_remove_table is used to free * pages containing page tables. * * *) ptes can be read atomically by the architecture. * * *) access_ok is sufficient to validate userspace address ranges. * * The last two assumptions can be relaxed by the addition of helper functions. doesn't look promising - access_ok() is never sufficient. Something like _PAGE_USER tests in x86 one solves that problem, but if anything similar works for HAVE_GENERIC_RCU_GUP I don't see it. Thus the question re what am I missing here...
