lkml.org 
[lkml]   [2019]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC PATCH v2 3/5] x86/sgx: Enforce noexec filesystem restriction for enclaves
    On Wed, Jun 05, 2019 at 07:11:43PM -0700, Sean Christopherson wrote:
    > + goto out;
    > + }
    > +
    > + /*
    > + * Query VM_MAYEXEC as an indirect path_noexec() check (see do_mmap()),
    > + * but with some future proofing against other cases that may deny
    > + * execute permissions.
    > + */
    > + if (!(vma->vm_flags & VM_MAYEXEC)) {
    > + ret = -EACCES;
    > + goto out;
    > + }
    > +
    > + if (copy_from_user(dst, (void __user *)src, PAGE_SIZE))
    > + ret = -EFAULT;
    > + else
    > + ret = 0;
    > +
    > +out:
    > + up_read(&current->mm->mmap_sem);
    > +
    > + return ret;
    > +}

    I would suggest to express the above instead like this for clarity
    and consistency:

    goto err_map_sem;
    }

    /* Query VM_MAYEXEC as an indirect path_noexec() check
    * (see do_mmap()).
    */
    if (!(vma->vm_flags & VM_MAYEXEC)) {
    ret = -EACCES;
    goto err_mmap_sem;
    }

    if (copy_from_user(dst, (void __user *)src, PAGE_SIZE)) {
    ret = -EFAULT;
    goto err_mmap_sem;
    }

    return 0;

    err_mmap_sem:
    up_read(&current->mm->mmap_sem);
    return ret;
    }

    The comment about future proofing is unnecessary.

    /Jarkk

    \
     
     \ /
      Last update: 2019-06-10 18:01    [W:4.238 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site