On Fri, 16 Sep 2022 06:59:51 -0700 Kees Cook <keescook@xxxxxxxxxxxx> wrote: > Hi, > > This fixes a find_vmap_area() deadlock. The main fix is patch 2, repeated here: > > The check_object_size() helper under CONFIG_HARDENED_USERCOPY is > designed to skip any checks where the length is known at compile time as > a reasonable heuristic to avoid "likely known-good" cases. However, it can > only do this when the copy_*_user() helpers are, themselves, inline too. > > Using find_vmap_area() requires taking a spinlock. The check_object_size() > helper can call find_vmap_area() when the destination is in vmap memory. > If show_regs() is called in interrupt context, it will attempt a call to > copy_from_user_nmi(), which may call check_object_size() and then > find_vmap_area(). If something in normal context happens to be in the > middle of calling find_vmap_area() (with the spinlock held), the interrupt > handler will hang forever. > > The copy_from_user_nmi() call is actually being called with a fixed-size > length, so check_object_size() should never have been called in the > first place. In order for check_object_size() to see that the length is > a fixed size, inline copy_from_user_nmi(), as already done with all the > other uaccess helpers. > Why is this so complicated. There's virtually zero value in running all those debug checks from within copy_from_user_nmi(). --- a/arch/x86/lib/usercopy.c~a +++ a/arch/x86/lib/usercopy.c @@ -44,7 +44,7 @@ copy_from_user_nmi(void *to, const void * called from other contexts. */ pagefault_disable(); - ret = __copy_from_user_inatomic(to, from, n); + ret = raw_copy_from_user(to, from, n); pagefault_enable(); return ret; _
