Commit 5b24a7a2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Add 'unsafe' user access functions for batched accesses 



The naming is meant to discourage random use: the helper functions are
not really any more "unsafe" than the traditional double-underscore
functions (which need the address range checking), but they do need even
more infrastructure around them, and should not be used willy-nilly.

In addition to checking the access range, these user access functions
require that you wrap the user access with a "user_acess_{begin,end}()"
around it.

That allows architectures that implement kernel user access control
(x86: SMAP, arm64: PAN) to do the user access control in the wrapping
user_access_begin/end part, and then batch up the actual user space
accesses using the new interfaces.

The main (and hopefully only) use for these are for core generic access
helpers, initially just the generic user string functions
(strnlen_user() and strncpy_from_user()).

Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 11f1a4b9

arch/x86/include/asm/uaccess.h

+25 −0
Original line number Diff line number Diff line
@@ -762,5 +762,30 @@ copy_to_user(void __user *to, const void *from, unsigned long n) 
#undef __copy_from_user_overflow

#undef __copy_to_user_overflow



/*

 * The "unsafe" user accesses aren't really "unsafe", but the naming

 * is a big fat warning: you have to not only do the access_ok()

 * checking before using them, but you have to surround them with the

 * user_access_begin/end() pair.

 */

#define user_access_begin()	__uaccess_begin()

#define user_access_end()	__uaccess_end()



#define unsafe_put_user(x, ptr)						\

({										\

	int __pu_err;								\

	__put_user_size((x), (ptr), sizeof(*(ptr)), __pu_err, -EFAULT);		\

	__builtin_expect(__pu_err, 0);						\

})



#define unsafe_get_user(x, ptr)						\

({										\

	int __gu_err;								\

	unsigned long __gu_val;							\

	__get_user_size(__gu_val, (ptr), sizeof(*(ptr)), __gu_err, -EFAULT);	\

	(x) = (__force __typeof__(*(ptr)))__gu_val;				\

	__builtin_expect(__gu_err, 0);						\

})



#endif /* _ASM_X86_UACCESS_H */

include/linux/uaccess.h

+7 −0
Original line number Diff line number Diff line
@@ -111,4 +111,11 @@ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count); 
#define probe_kernel_address(addr, retval)		\

	probe_kernel_read(&retval, addr, sizeof(retval))



#ifndef user_access_begin

#define user_access_begin() do { } while (0)

#define user_access_end() do { } while (0)

#define unsafe_get_user(x, ptr) __get_user(x, ptr)

#define unsafe_put_user(x, ptr) __put_user(x, ptr)

#endif



#endif		/* __LINUX_UACCESS_H__ */

CRA Git | Maintained and supported by SUSTech CRA and CCSE