On Tue, Jul 13, 2021 at 05:59:58PM +0100, Will Deacon wrote:

On Mon, Jul 12, 2021 at 03:27:46PM +0100, Robin Murphy wrote:

quoted

Al reminds us that the usercopy API must only return complete failure
if absolutely nothing could be copied. Currently, if userspace does
something silly like giving us an unaligned pointer to Device memory,
or a size which overruns MTE tag bounds, we may fail to honour that
requirement when faulting on a multi-byte access even though a smaller
access could have succeeded.

Add a mitigation to the fixup routines to fall back to a single-byte
copy if we faulted on a larger access before anything has been written
to the destination, to guarantee making *some* forward progress. We
needn't be too concerned about the overall performance since this should
only occur when callers are doing something a bit dodgy in the first
place. Particularly broken userspace might still be able to trick
generic_perform_write() into an infinite loop by targeting write() at
an mmap() of some read-only device register where the fault-in load
succeeds but any store synchronously aborts such that copy_to_user() is
genuinely unable to make progress, but, well, don't do that...

CC: stable@vger.kernel.org
Reported-by: Chen Huang <redacted>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
---

I've started trying the "replay" approach for figuring out more precise
remainders in general, but that quickly got more complicated with
rebasing the fault address passing stuff, so I'm resending this now as
a point fix and will continue to explore that as an improvement on top.

Is it possible to add/extend a selftest for this, please? I think Catalin
mentioned that before, but not sure if he got anywhere with it.

It's on my to-do list but going on holiday soon. If Robin is keen on
this, I don't really mind ;).

-- 
Catalin