Re: [PATCH v2 1/2] mm: add probe_user_read()

[Christophe Leroy]

Le 08/01/2019 Ã 20:48, Andrew Morton a ÃcritÂ:
> On Tue,  8 Jan 2019 07:37:44 +0000 (UTC) Christophe Leroy <christophe.leroy@xxxxxx> wrote:
>
> > In powerpc code, there are several places implementing safe
> > access to user data. This is sometimes implemented using
> > probe_kernel_address() with additional access_ok() verification,
> > sometimes with get_user() enclosed in a pagefault_disable()/enable()
> > pair, etc. :
> >      show_user_instructions()
> >      bad_stack_expansion()
> >      p9_hmi_special_emu()
> >      fsl_pci_mcheck_exception()
> >      read_user_stack_64()
> >      read_user_stack_32() on PPC64
> >      read_user_stack_32() on PPC32
> >      power_pmu_bhrb_to()
> >
> > In the same spirit as probe_kernel_read(), this patch adds
> > probe_user_read().
> >
> > probe_user_read() does the same as probe_kernel_read() but
> > first checks that it is really a user address.
> >
> > ...
> >
> > --- a/include/linux/uaccess.h
> > +++ b/include/linux/uaccess.h
> > @@ -263,6 +263,40 @@ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
> >   #define probe_kernel_address(addr, retval)		\
> >   	probe_kernel_read(&retval, addr, sizeof(retval))
> >   
> > +/**
> > + * probe_user_read(): safely attempt to read from a user location
> > + * @dst: pointer to the buffer that shall take the data
> > + * @src: address to read from
> > + * @size: size of the data chunk
> > + *
> > + * Returns: 0 on success, -EFAULT on error.
> > + *
> > + * Safely read from address @src to the buffer at @dst.  If a kernel fault
> > + * happens, handle that and return -EFAULT.
> > + *
> > + * We ensure that the copy_from_user is executed in atomic context so that
> > + * do_page_fault() doesn't attempt to take mmap_sem.  This makes
> > + * probe_user_read() suitable for use within regions where the caller
> > + * already holds mmap_sem, or other locks which nest inside mmap_sem.
> > + */
> > +
> > +#ifndef probe_user_read
> > +static __always_inline long probe_user_read(void *dst, const void __user *src,
> > +					    size_t size)
> > +{
> > +	long ret;
> > +
> > +	if (!access_ok(src, size))
> > +		return -EFAULT;
> > +
> > +	pagefault_disable();
> > +	ret = __copy_from_user_inatomic(dst, src, size);
> > +	pagefault_enable();
> > +
> > +	return ret ? -EFAULT : 0;
> > +}
> > +#endif
>
> Why was the __always_inline needed?
>
> This function is pretty large.  Why is it inlined?

Kees told to do that way, see https://patchwork.ozlabs.org/patch/986848/

Christophe