• L
    x86: fix special __probe_kernel_write() tail zeroing case · d869844b
    Linus Torvalds 提交于
    Commit cae2a173 ("x86: clean up/fix 'copy_in_user()' tail zeroing")
    fixed the failure case tail zeroing of one special case of the x86-64
    generic user-copy routine, namely when used for the user-to-user case
    ("copy_in_user()").
    
    But in the process it broke an even more unusual case: using the user
    copy routine for kernel-to-kernel copying.
    
    Now, normally kernel-kernel copies are obviously done using memcpy(),
    but we have a couple of special cases when we use the user-copy
    functions.  One is when we pass a kernel buffer to a regular user-buffer
    routine, using set_fs(KERNEL_DS).  That's a "normal" case, and continued
    to work fine, because it never takes any faults (with the possible
    exception of a silent and successful vmalloc fault).
    
    But Jan Beulich pointed out another, very unusual, special case: when we
    use the user-copy routines not because it's a path that expects a user
    pointer, but for a couple of ftrace/kgdb cases that want to do a kernel
    copy, but do so using "unsafe" buffers, and use the user-copy routine to
    gracefully handle faults.  IOW, for probe_kernel_write().
    
    And that broke for the case of a faulting kernel destination, because we
    saw the kernel destination and wanted to try to clear the tail of the
    buffer.  Which doesn't work, since that's what faults.
    
    This only triggers for things like kgdb and ftrace users (eg trying
    setting a breakpoint on read-only memory), but it's definitely a bug.
    The fix is to not compare against the kernel address start (TASK_SIZE),
    but instead use the same limits "access_ok()" uses.
    Reported-and-tested-by: NJan Beulich <jbeulich@suse.com>
    Cc: stable@vger.kernel.org # 4.0
    Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
    d869844b
usercopy_64.c 2.1 KB