From: Alice Ryhl <aliceryhl@google.com>
To: David Laight <David.Laight@aculab.com>
Cc: "Trevor Gross" <tmgross@umich.edu>,
"Miguel Ojeda" <ojeda@kernel.org>,
"Alex Gaynor" <alex.gaynor@gmail.com>,
"Wedson Almeida Filho" <wedsonaf@gmail.com>,
"Boqun Feng" <boqun.feng@gmail.com>,
"Gary Guo" <gary@garyguo.net>,
"Björn Roy Baron" <bjorn3_gh@protonmail.com>,
"Benno Lossin" <benno.lossin@proton.me>,
"Andreas Hindborg" <a.hindborg@samsung.com>,
"Kees Cook" <keescook@chromium.org>,
"Al Viro" <viro@zeniv.linux.org.uk>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Arve Hjønnevåg" <arve@android.com>,
"Todd Kjos" <tkjos@android.com>,
"Martijn Coenen" <maco@android.com>,
"Joel Fernandes" <joel@joelfernandes.org>,
"Carlos Llamas" <cmllamas@google.com>,
"Suren Baghdasaryan" <surenb@google.com>,
"Arnd Bergmann" <arnd@arndb.de>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"rust-for-linux@vger.kernel.org" <rust-for-linux@vger.kernel.org>,
"Christian Brauner" <brauner@kernel.org>
Subject: Re: [PATCH 1/3] rust: add userspace pointers
Date: Mon, 12 Feb 2024 10:30:24 +0100 [thread overview]
Message-ID: <CAH5fLgiRgg2zD3tJ9Xrvk+bvH3srDGw9ud_gjRa97cd7a+jROA@mail.gmail.com> (raw)
In-Reply-To: <405e8b56cd0c48d0ba640e8d9c60179e@AcuMS.aculab.com>
On Sat, Feb 10, 2024 at 3:15 PM David Laight <David.Laight@aculab.com> wrote:
>
> ...
> > > Maybe something like
> > >
> > > Every time a memory location is read, the reader's position is advanced by
> > > the read length and the next read will start from there. This helps prevent
> > > accidentally reading the same location twice and causing a TOCTOU bug.
>
> WTF TOCTOU? I'm guessing it is reading things twice and getting
> different answers.
Yes. In v2 of this patchset [1], I expanded TOCTOU to "time-of-check
to time-of-use" at the first use to reduce this confusion.
> That really doesn't match how copying from userspace is used is many places.
> Sometimes you really do want to be using offsets and lengths.
> For instance the user buffer might contain offsets of items further
> down the buffer.
For this use-case, you can call UserSlice::new multiple times, or use
clone_reader. This use-case does appear sometimes in Rust Binder and
is supported, but I didn't find it to be the most common use-case.
> There is also the code (eg ioctl) that does a read-modify-write
> on a buffer.
The read-modify-write use-case is quite common in Rust Binder and is
supported by the API provided by this patchset. When you call
reader_writer, you get a separate reader and writer. Then, you first
use the reader to read the data. Then you modify it. Then you use the
writer to write it back.
> > > + /// Reads the entirety of the user slice.
> > > + ///
> > > + /// Returns `EFAULT` if the address does not currently point to
> > > + /// mapped, readable memory.
> > > + pub fn read_all(self) -> Result<Vec<u8>> {
> > > + self.reader().read_all()
> > > + }
> >
> > If I understand it correctly, the function will return `EFAULT` if _any_
> > address in the interval `[self.0, self.0 + self.1)` does not point to
> > mapped, readable memory. Maybe the docs could be more explicit.
>
> That isn't (and can't be) how it works.
> access_ok() checks that the buffer isn't in kernel space.
> The copy is then done until it actually faults on an invalid address.
> In that case the destination buffer has been updated to the point
> of failure.
>
> You can't do a check before the copy because another thread can
> change the mapping (it would also be horribly expensive).
This was reworded in v2 [1]:
/// Fails with `EFAULT` if the read encounters a page fault.
But ultimately, the real condition here is just that it returns EFAULT
if copy_from_user fails. I'm happy to reword further.
Alice
[1]: https://lore.kernel.org/all/20240208-alice-mm-v2-1-d821250204a6@google.com/
next prev parent reply other threads:[~2024-02-12 9:30 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-24 11:20 [PATCH 0/3] Memory management patches needed by Rust Binder Alice Ryhl
2024-01-24 11:20 ` [PATCH 1/3] rust: add userspace pointers Alice Ryhl
2024-01-24 23:12 ` Valentin Obst
2024-02-08 12:20 ` Alice Ryhl
2024-02-01 4:06 ` Trevor Gross
2024-02-08 12:53 ` Alice Ryhl
2024-02-08 15:35 ` Greg Kroah-Hartman
2024-02-08 15:41 ` Alice Ryhl
2024-02-08 15:59 ` Greg Kroah-Hartman
2024-02-10 6:20 ` Kees Cook
2024-02-10 7:06 ` Trevor Gross
2024-02-10 14:14 ` David Laight
2024-02-12 9:30 ` Alice Ryhl [this message]
2024-01-24 11:20 ` [PATCH 2/3] rust: add typed accessors for " Alice Ryhl
2024-01-24 23:46 ` Valentin Obst
2024-01-25 12:40 ` Alice Ryhl
2024-01-25 12:26 ` Arnd Bergmann
2024-01-25 12:37 ` Alice Ryhl
2024-01-25 15:59 ` Arnd Bergmann
2024-01-25 16:15 ` Alice Ryhl
2024-02-01 5:03 ` Trevor Gross
2024-02-08 13:14 ` Alice Ryhl
2024-01-24 11:20 ` [PATCH 3/3] rust: add abstraction for `struct page` Alice Ryhl
2024-01-26 0:46 ` Boqun Feng
2024-01-26 12:33 ` Alice Ryhl
2024-01-26 18:28 ` Boqun Feng
2024-02-01 6:50 ` Trevor Gross
2024-02-05 17:23 ` Boqun Feng
2024-02-08 13:36 ` Alice Ryhl
2024-01-30 9:15 ` Andreas Hindborg (Samsung)
2024-01-29 17:59 ` Matthew Wilcox
2024-01-29 18:56 ` Carlos Llamas
2024-01-29 20:19 ` Matthew Wilcox
2024-01-29 21:27 ` Alice Ryhl
2024-01-30 9:02 ` Andreas Hindborg
2024-01-30 9:06 ` Alice Ryhl
2024-02-01 6:02 ` Trevor Gross
2024-02-08 13:46 ` Alice Ryhl
2024-02-08 14:02 ` Andreas Hindborg
2024-02-08 14:12 ` Alice Ryhl
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAH5fLgiRgg2zD3tJ9Xrvk+bvH3srDGw9ud_gjRa97cd7a+jROA@mail.gmail.com \
--to=aliceryhl@google.com \
--cc=David.Laight@aculab.com \
--cc=a.hindborg@samsung.com \
--cc=akpm@linux-foundation.org \
--cc=alex.gaynor@gmail.com \
--cc=arnd@arndb.de \
--cc=arve@android.com \
--cc=benno.lossin@proton.me \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun.feng@gmail.com \
--cc=brauner@kernel.org \
--cc=cmllamas@google.com \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=joel@joelfernandes.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=maco@android.com \
--cc=ojeda@kernel.org \
--cc=rust-for-linux@vger.kernel.org \
--cc=surenb@google.com \
--cc=tkjos@android.com \
--cc=tmgross@umich.edu \
--cc=viro@zeniv.linux.org.uk \
--cc=wedsonaf@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).