arch_ptrace() uses of access_ok() are pointless

RFC PATCH In review Al Viro 2 participants 3 messages May 27, 2018 – May 28, 2018

Subsystems (2)

PowerPC ptrace support

lore

Share & tools

lore

Al Viro

author

2018-05-27 22:34 UTC #0 lore raw

RFC PATCH 1/1 arch_ptrace() uses of access_ok() are pointless

make it use copy_{from,to}_user(), rather than access_ok() + __copy_...

Signed-off-by Al Viro <[email protected]>

---
 arch/powerpc/kernel/ptrace.c | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

arch/powerpc/kernel/ptrace.c +7 ~~-15~~

index d23cf632edf0..d8b0fd2fa3aa 100644
@@ -3081,27 +3081,19 @@ long arch_ptrace(struct task_struct *child, long request,
 #endif /* CONFIG_HAVE_HW_BREAKPOINT */
 #endif /* CONFIG_PPC_ADV_DEBUG_REGS */
 
-		if (!access_ok(VERIFY_WRITE, datavp,
-			       sizeof(struct ppc_debug_info)))
+		if (unlikely(copy_to_user(datavp, &dbginfo,
+				     sizeof(struct ppc_debug_info)))
 			return -EFAULT;
-		ret = __copy_to_user(datavp, &dbginfo,
-				     sizeof(struct ppc_debug_info)) ?
-		      -EFAULT : 0;
-		break;
+		return 0;
 	}
 
 	case PPC_PTRACE_SETHWDEBUG: {
 		struct ppc_hw_breakpoint bp_info;
 
-		if (!access_ok(VERIFY_READ, datavp,
-			       sizeof(struct ppc_hw_breakpoint)))
-			return -EFAULT;
-		ret = __copy_from_user(&bp_info, datavp,
-				       sizeof(struct ppc_hw_breakpoint)) ?
-		      -EFAULT : 0;
-		if (!ret)
-			ret = ppc_set_hwdebug(child, &bp_info);
-		break;
+		if (unlikely(copy_from_user(&bp_info, datavp,
+				       sizeof(struct ppc_hw_breakpoint)))
+		      return -EFAULT;
+		return ppc_set_hwdebug(child, &bp_info);
 	}
 
 	case PPC_PTRACE_DELHWDEBUG: {

Signature · 1 line

2.11.0

Mathieu Malaterre

2018-05-28 19:26 UTC #1 lore raw

Quoted 13 lines · Al Viro

make it use copy_{from,to}_user(), rather than access_ok() + __copy_...
Signed-off-by Al Viro <[email protected]>
---
 arch/powerpc/kernel/ptrace.c | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)
arch/powerpc/kernel/ptrace.c +0 -0
index d23cf632edf0..d8b0fd2fa3aa 100644

arch/powerpc/kernel/ptrace.c long arch_ptrace(struct task_struct *child, long request, · line 3085

Quoted 7 lines

arch/powerpc/kernel/ptrace.c +2 -2

@@ -3081,27 +3081,19 @@ long arch_ptrace(struct task_struct *child, long request,
 #endif /* CONFIG_HAVE_HW_BREAKPOINT */
 #endif /* CONFIG_PPC_ADV_DEBUG_REGS */
 
-               if (!access_ok(VERIFY_WRITE, datavp,
-                              sizeof(struct ppc_debug_info)))
+               if (unlikely(copy_to_user(datavp, &dbginfo,
+                                    sizeof(struct ppc_debug_info)))

Maybe this is just an RFC, but:

CALL ../arch/powerpc/kernel/systbl_chk.sh
../arch/powerpc/kernel/ptrace.c: In function ‘arch_ptrace’:
../arch/powerpc/kernel/ptrace.c:3086:4: error: expected ‘)’ before ‘return’

    return -EFAULT;
    ^~~~~~

Missing closing parenthesis.

Quoted 30 lines

arch/powerpc/kernel/ptrace.c +5 ~~-14~~

                        return -EFAULT;
-               ret = __copy_to_user(datavp, &dbginfo,
-                                    sizeof(struct ppc_debug_info)) ?
-                     -EFAULT : 0;
-               break;
+               return 0;
        }
 
        case PPC_PTRACE_SETHWDEBUG: {
                struct ppc_hw_breakpoint bp_info;
 
-               if (!access_ok(VERIFY_READ, datavp,
-                              sizeof(struct ppc_hw_breakpoint)))
-                       return -EFAULT;
-               ret = __copy_from_user(&bp_info, datavp,
-                                      sizeof(struct ppc_hw_breakpoint)) ?
-                     -EFAULT : 0;
-               if (!ret)
-                       ret = ppc_set_hwdebug(child, &bp_info);
-               break;
+               if (unlikely(copy_from_user(&bp_info, datavp,
+                                      sizeof(struct ppc_hw_breakpoint)))
+                     return -EFAULT;
+               return ppc_set_hwdebug(child, &bp_info);
        }
 
        case PPC_PTRACE_DELHWDEBUG: {
--

2.11.0

Al Viro

author

2018-05-28 20:30 UTC #2 lore raw

Quoted 8 lines

Maybe this is just an RFC, but:
CALL ../arch/powerpc/kernel/systbl_chk.sh
../arch/powerpc/kernel/ptrace.c: In function ‘arch_ptrace’:
../arch/powerpc/kernel/ptrace.c:3086:4: error: expected ‘)’ before ‘return’
    return -EFAULT;
    ^~~~~~

and the same a few lines later. What's more, those 'unlikely' are pointless there. Fixed variant follows; only build-tested, though.

make it use copy_{from,to}_user(), rather than access_ok() + __copy_...

Signed-off-by Al Viro <[email protected]>

---
 arch/powerpc/kernel/ptrace.c | 22 +++++++---------------
 1 file changed, 7 insertions(+), 15 deletions(-)

arch/powerpc/kernel/ptrace.c +7 ~~-15~~

index d23cf632edf0..f557322621e0 100644
@@ -3081,27 +3081,19 @@ long arch_ptrace(struct task_struct *child, long request,
 #endif /* CONFIG_HAVE_HW_BREAKPOINT */
 #endif /* CONFIG_PPC_ADV_DEBUG_REGS */
 
-		if (!access_ok(VERIFY_WRITE, datavp,
-			       sizeof(struct ppc_debug_info)))
+		if (copy_to_user(datavp, &dbginfo,
+				     sizeof(struct ppc_debug_info)))
 			return -EFAULT;
-		ret = __copy_to_user(datavp, &dbginfo,
-				     sizeof(struct ppc_debug_info)) ?
-		      -EFAULT : 0;
-		break;
+		return 0;
 	}
 
 	case PPC_PTRACE_SETHWDEBUG: {
 		struct ppc_hw_breakpoint bp_info;
 
-		if (!access_ok(VERIFY_READ, datavp,
-			       sizeof(struct ppc_hw_breakpoint)))
-			return -EFAULT;
-		ret = __copy_from_user(&bp_info, datavp,
-				       sizeof(struct ppc_hw_breakpoint)) ?
-		      -EFAULT : 0;
-		if (!ret)
-			ret = ppc_set_hwdebug(child, &bp_info);
-		break;
+		if (copy_from_user(&bp_info, datavp,
+				       sizeof(struct ppc_hw_breakpoint)))
+		      return -EFAULT;
+		return ppc_set_hwdebug(child, &bp_info);
 	}
 
 	case PPC_PTRACE_DELHWDEBUG: {

Signature · 1 line

2.11.0