Re: [PATCH v3] mm/usercopy: get rid of CONFIG_DEBUG_STRICT_USER_COPY_CHECKS

[Mark Rutland]

On Tue, Aug 30, 2016 at 09:13:32PM +0100, Al Viro wrote:
> On Tue, Aug 30, 2016 at 02:15:58PM -0400, Kees Cook wrote:
> 
> > First, some current API usage which we'll need to maintain at least
> > for now: __copy_*_user() is just copy_*_user() without the access_ok()
> > checks. Unfortunately, some arch implement different copying methods
> > depending on if the entry is via copy...() or __copy..() (e.g. see
> > x86's use of _copy...() -- single underscore??) There doesn't seem to
> > be a good reason for this, and I think it would make sense to extract
> > the actual per-arch implementation that performs the real copy into
> > something like arm64's __arch_copy_*_user(), which only does the copy
> > itself and nothing else.
> 
> No.  __arch_copy_from_user() is a bloody bad idea; the real primitive
> is what's currently called __copy_from_user_inatomic(), and I'm planning
> to rename it to raw_copy_from_user(). 

Great!

FWIW, my plan with the arch_* forms was to follow the convention set by
the spinlock code and have raw_* forms build atop of these, where common
debug and/or hardening checks would live.

>From my PoV, anything to make this more consistent cross-architecture is
good, especially if we can pull the duplicated logic into common code.

Thanks,
Mark.