Originally, the rule used to be that you'd have to do access_ok() separately, and then user_access_begin() before actually doing the direct (optimized) user access. But experience has shown that people then decide not to do access_ok() at all, and instead rely on it being implied by other operations or similar. Which makes it very hard to verify that the access has actually been range-checked. If you use the unsafe direct user accesses, hardware features (either SMAP - Supervisor Mode Access Protection - on x86, or PAN - Privileged Access Never - on ARM) do force you to use user_access_begin(). But nothing really forces the range check. By putting the range check into user_access_begin(), we actually force people to do the right thing (tm), and the range check vill be visible near the actual accesses. We have way too long a history of people trying to avoid them.
Showing the changes to include/linux (1 of 7 files). Show all
Unified · Split
| @@ -264,7 +264,7 @@ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count); · 263 unmodified lines | ||
| 264 | 264 | probe_kernel_read(&retval, addr, sizeof(retval)) |
| 265 | 265 | |
| 266 | 266 | #ifndef user_access_begin |
| 267 | −#define user_access_begin() do { } while (0) | |
| 267 | +#define user_access_begin(ptr,len) access_ok(ptr, len) | |
| 268 | 268 | #define user_access_end() do { } while (0) |
| 269 | 269 | #define unsafe_get_user(x, ptr, err) do { if (unlikely(__get_user(x, ptr))) goto err; } while (0) |
| 270 | 270 | #define unsafe_put_user(x, ptr, err) do { if (unlikely(__put_user(x, ptr))) goto err; } while (0) |