Re: [PATCH] x86/uaccess: Zero the 8-byte get_range case on failure

[Linus Torvalds]

On Wed, 31 Jul 2024 at 09:24, Linus Torvalds
<torvalds@xxxxxxxxxxxxxxxxxxxx> wrote:
>
> My bad. My mental model these days is the 64-bit case, where the whole
> 'check_range' thing is about address masking tricks, not the actual
> conditional. So I didn't think of the "access_ok fails" case at all.

Actually, now that I said that out loud, it made me go "why aren't we
doing that on 32-bit too?"

IOW, an alternative would be to just unify things more. Something like this?

*ENTIRELY UNTESTED*.

And no, this is not a NAK of David's patch. Last time I said "let's
unify things", it caused this bug.

I'm claiming that finishing that unification will fix the bug again,
and I *think* we leave that top address unmapped on 32-bit x86 too,
but this whole trick does very much depend on that "access to all-one
address is guaranteed to fail".

So this is the "maybe cleaner, but somebody really needs to
double-check me" patch.

             Linus
 arch/x86/lib/getuser.S | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
index a314622aa093..3ee80b9c4f78 100644
--- a/arch/x86/lib/getuser.S
+++ b/arch/x86/lib/getuser.S
@@ -44,9 +44,9 @@
 	or %rdx, %rax
 .else
 	cmp $TASK_SIZE_MAX-\size+1, %eax
-	jae .Lbad_get_user
 	sbb %edx, %edx		/* array_index_mask_nospec() */
-	and %edx, %eax
+	not %edx
+	or %edx, %eax
 .endif
 .endm
 
@@ -153,7 +153,6 @@ EXPORT_SYMBOL(__get_user_nocheck_8)
 
 SYM_CODE_START_LOCAL(__get_user_handle_exception)
 	ASM_CLAC
-.Lbad_get_user:
 	xor %edx,%edx
 	mov $(-EFAULT),%_ASM_AX
 	RET