From owner-svn-src-all@freebsd.org  Thu Sep  6 15:24:36 2018
Return-Path: <owner-svn-src-all@freebsd.org>
Delivered-To: svn-src-all@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 91F03FFE303;
 Thu,  6 Sep 2018 15:24:36 +0000 (UTC) (envelope-from jhb@FreeBSD.org)
Received: from mail.baldwin.cx (bigwig.baldwin.cx [IPv6:2001:470:1f11:75::1])
 (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 3E68A7BB75;
 Thu,  6 Sep 2018 15:24:36 +0000 (UTC) (envelope-from jhb@FreeBSD.org)
Received: from John-Baldwins-MacBook-Pro-2.local (ralph.baldwin.cx
 [66.234.199.215])
 by mail.baldwin.cx (Postfix) with ESMTPSA id C4C8910A87D;
 Thu,  6 Sep 2018 11:24:34 -0400 (EDT)
Subject: Re: svn commit: r338494 - head/sys/cam/ctl
To: Shawn Webb <shawn.webb@hardenedbsd.org>, Alexander Motin <mav@FreeBSD.org>
References: <201809061403.w86E3AUm097915@repo.freebsd.org>
 <20180906145421.7mejwhcfezwtsk4k@mutt-hbsd>
Cc: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
From: John Baldwin <jhb@FreeBSD.org>
Message-ID: <51c27534-8cc2-cd30-dd53-77fd7ad5bdf7@FreeBSD.org>
Date: Thu, 6 Sep 2018 08:24:32 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <20180906145421.7mejwhcfezwtsk4k@mutt-hbsd>
Content-Type: text/plain; charset=windows-1252
Content-Language: en-US
Content-Transfer-Encoding: 8bit
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.4.3
 (mail.baldwin.cx); Thu, 06 Sep 2018 11:24:35 -0400 (EDT)
X-Virus-Scanned: clamav-milter 0.99.2 at mail.baldwin.cx
X-Virus-Status: Clean
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
 user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all/>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Sep 2018 15:24:36 -0000

On 9/6/18 7:54 AM, Shawn Webb wrote:
> On Thu, Sep 06, 2018 at 02:03:10PM +0000, Alexander Motin wrote:
>> Author: mav
>> Date: Thu Sep  6 14:03:10 2018
>> New Revision: 338494
>> URL: https://svnweb.freebsd.org/changeset/base/338494
>>
>> Log:
>>   Add missing copyin() to access LUN and port ioctl arguments.
>>   
>>   Somehow this was working even after PTI in, at least on amd64, and got
>>   broken by something only very recently.
> 
> Is anyone investigating why the direct access still worked?

PTI doesn't disable kernel access to user pages, it only disables
translation of kernel virtual addresses while in user mode.  The thing that
catches this type of access is SMAP (which was only recently enabled on
x86).

-- 
John Baldwin