Re: [PATCH v2 11/17] selftests/x86/ldt_gdt: Prepare for access bit forced

[Andy Lutomirski]

> On Dec 14, 2017, at 1:48 PM, Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
> 
> On Thu, Dec 14, 2017 at 1:44 PM, Linus Torvalds
> <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
>> 
>> So it clearly needs to have the PAGE_USER bit clear (to avoid users
>> accessing it directly), and it needs to be marked somehow for
>> get_user_pages() to refuse it too, and access_ok() needs to fail it so
>> that we can't do get_user/put_user on it.
> 
> Actually, just clearing PAGE_USER should make gup avoid it automatically.
> 
> So really the only other thing it needs is to have access_ok() avoid
> it so that the kernel can't be fooled into accessing it for the user.
> 
> That does probably mean having to put it at the top of the user
> address space and playing games with user_addr_max(). Which is not
> wonderful, but certainly not rocket surgery either.

That seems to rather defeat the point of using a VMA, though.  And it means we still have to do a full cmp instead of just checking a sign bit in access_ok if we ever manage to kill set_fs().

Again, I have an apparently fully functional patch to alias the LDT at a high (kernel) address where we can cleanly map it in the user pagetables without any of this VMA stuff.  It's much less code.