similar to: [PATCH 0/3] vhost: fix use_mm usage

On biarch kernels, it is not safe to do copy from/to user, even with use_mm, unless we checked the address range with access_ok previously. Implement these checks to enforce safe memory accesses. Reported-by: Al Viro <viro at zeniv.linux.org.uk> Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- drivers/vhost/net.c | 17 ++++++- drivers/vhost/vhost.c | 111

On biarch kernels, it is not safe to do copy from/to user, even with use_mm, unless we checked the address range with access_ok previously. Implement these checks to enforce safe memory accesses. Reported-by: Al Viro <viro at zeniv.linux.org.uk> Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- drivers/vhost/net.c | 17 ++++++- drivers/vhost/vhost.c | 111

On Fri, Nov 02, 2018 at 10:10:45AM -0700, Linus Torvalds wrote: > On Fri, Nov 2, 2018 at 9:59 AM Michael S. Tsirkin <mst at redhat.com> wrote: > > > > Just for completeness I'd like to point out for vhost the copies are > > done from the kernel thread. So yes we can switch to copy_to/from_user > > but for e.g. 32-bit userspace running on top of a 64 bit kernel

On Fri, Nov 02, 2018 at 10:10:45AM -0700, Linus Torvalds wrote: > On Fri, Nov 2, 2018 at 9:59 AM Michael S. Tsirkin <mst at redhat.com> wrote: > > > > Just for completeness I'd like to point out for vhost the copies are > > done from the kernel thread. So yes we can switch to copy_to/from_user > > but for e.g. 32-bit userspace running on top of a 64 bit kernel

vhost net module wants to do copy to/from user from a kernel thread, which needs use_mm (like what fs/aio has). Move that into mm/ and export to modules. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- fs/aio.c | 47 +---------------------------------- include/linux/mmu_context.h | 9 ++++++ mm/Makefile | 2 +- mm/mmu_context.c

vhost net module wants to do copy to/from user from a kernel thread, which needs use_mm (like what fs/aio has). Move that into mm/ and export to modules. Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- fs/aio.c | 47 +---------------------------------- include/linux/mmu_context.h | 9 ++++++ mm/Makefile | 2 +- mm/mmu_context.c

On Fri, Nov 02, 2018 at 09:14:51AM -0700, Linus Torvalds wrote: > On Fri, Nov 2, 2018 at 6:04 AM Michael S. Tsirkin <mst at redhat.com> wrote: > > > > I've tried making access_ok mask the parameter it gets. > > PLEASE don't do this. Okay. > Just use "copy_to/from_user()". Just for completeness I'd like to point out for vhost the copies are

On Fri, Nov 02, 2018 at 09:14:51AM -0700, Linus Torvalds wrote: > On Fri, Nov 2, 2018 at 6:04 AM Michael S. Tsirkin <mst at redhat.com> wrote: > > > > I've tried making access_ok mask the parameter it gets. > > PLEASE don't do this. Okay. > Just use "copy_to/from_user()". Just for completeness I'd like to point out for vhost the copies are

vhost net module wants to do copy to/from user from a kernel thread, which needs use_mm (like what fs/aio has). Move that into mm/ and export to modules. Acked-by: Andrew Morton <akpm at linux-foundation.org> Acked-by: Andrea Arcangeli <aarcange at redhat.com> Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- fs/aio.c | 47

vhost net module wants to do copy to/from user from a kernel thread, which needs use_mm (like what fs/aio has). Move that into mm/ and export to modules. Acked-by: Andrew Morton <akpm at linux-foundation.org> Acked-by: Andrea Arcangeli <aarcange at redhat.com> Signed-off-by: Michael S. Tsirkin <mst at redhat.com> --- fs/aio.c | 47

From: Al Viro <viro at zeniv.linux.org.uk> just advance the msg.msg_iter and be done with that. Cc: Michael S. Tsirkin <mst at redhat.com> Cc: kvm at vger.kernel.org Cc: virtualization at lists.linux-foundation.org Signed-off-by: Al Viro <viro at zeniv.linux.org.uk> --- drivers/vhost/net.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git

From: Al Viro <viro at zeniv.linux.org.uk> just advance the msg.msg_iter and be done with that. Cc: Michael S. Tsirkin <mst at redhat.com> Cc: kvm at vger.kernel.org Cc: virtualization at lists.linux-foundation.org Signed-off-by: Al Viro <viro at zeniv.linux.org.uk> --- drivers/vhost/net.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git

From: Al Viro <viro at zeniv.linux.org.uk> Cc: Michael S. Tsirkin <mst at redhat.com> Cc: kvm at vger.kernel.org Cc: virtualization at lists.linux-foundation.org Signed-off-by: Al Viro <viro at zeniv.linux.org.uk> --- drivers/vhost/vhost.c | 6 ++++-- include/linux/uio.h | 1 - lib/iovec.c | 25 ------------------------- 3 files changed, 4 insertions(+), 28

From: Al Viro <viro at zeniv.linux.org.uk> Cc: Michael S. Tsirkin <mst at redhat.com> Cc: kvm at vger.kernel.org Cc: virtualization at lists.linux-foundation.org Signed-off-by: Al Viro <viro at zeniv.linux.org.uk> --- drivers/vhost/vhost.c | 6 ++++-- include/linux/uio.h | 1 - lib/iovec.c | 25 ------------------------- 3 files changed, 4 insertions(+), 28

From: Al Viro <viro at zeniv.linux.org.uk> it has just verified that it asks no more than the length of the first segment of iovec. And with that the last user of stuff in lib/iovec.c is gone. RIP. Cc: Michael S. Tsirkin <mst at redhat.com> Cc: Nicholas A. Bellinger <nab at linux-iscsi.org> Cc: kvm at vger.kernel.org Cc: virtualization at lists.linux-foundation.org

From: Al Viro <viro at zeniv.linux.org.uk> it has just verified that it asks no more than the length of the first segment of iovec. And with that the last user of stuff in lib/iovec.c is gone. RIP. Cc: Michael S. Tsirkin <mst at redhat.com> Cc: Nicholas A. Bellinger <nab at linux-iscsi.org> Cc: kvm at vger.kernel.org Cc: virtualization at lists.linux-foundation.org

On Fri, Nov 2, 2018 at 10:10 AM Linus Torvalds <torvalds at linux-foundation.org> wrote: > > Don't you take over the VM with "use_mm()" when you do the copies? So > yes, it's a kernel thread, but it has a user VM, and though that > should have the user limits. Oooh. *Just* as I sent this, I realized that "use_mm()" doesn't update the thread

From: Al Viro <viro at zeniv.linux.org.uk> Cc: Michael S. Tsirkin <mst at redhat.com> Cc: kvm at vger.kernel.org Cc: virtualization at lists.linux-foundation.org Signed-off-by: Al Viro <viro at zeniv.linux.org.uk> --- drivers/vhost/net.c | 82 +++++++++++++++-------------------------------------- include/linux/uio.h | 3 -- lib/iovec.c | 26 ----------------- 3 files

From: Al Viro <viro at zeniv.linux.org.uk> Cc: Michael S. Tsirkin <mst at redhat.com> Cc: kvm at vger.kernel.org Cc: virtualization at lists.linux-foundation.org Signed-off-by: Al Viro <viro at zeniv.linux.org.uk> --- drivers/vhost/net.c | 82 +++++++++++++++-------------------------------------- include/linux/uio.h | 3 -- lib/iovec.c | 26 ----------------- 3 files

Ok, I think I've addressed all comments so far here. Rusty, I'd like this to go into linux-next, through your tree, and hopefully 2.6.33. What do you think? --- This implements vhost: a kernel-level backend for virtio, The main motivation for this work is to reduce virtualization overhead for virtio by removing system calls on data path, without guest changes. For virtio-net, this