All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Miller <davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
To: paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org
Cc: netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org,
	selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org
Subject: Re: [PATCH] net: don't unnecessarily load kernel modules in dev_ioctl()
Date: Wed, 07 Mar 2018 15:13:32 -0500 (EST)	[thread overview]
Message-ID: <20180307.151332.565301474495395127.davem@davemloft.net> (raw)
In-Reply-To: <CAHC9VhR4FzwsAEO9O9Pnpkm2jOBajwZUkn_i0FqOMR_4ycag2g-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>

From: Paul Moore <paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org>
Date: Tue, 6 Mar 2018 17:32:47 -0500

> On Tue, Mar 6, 2018 at 5:27 PM, Paul Moore <pmoore-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
>> From: Paul Moore <paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org>
>>
>> Starting with v4.16-rc1 we've been seeing a higher than usual number
>> of requests for the kernel to load networking modules, even on events
>> which shouldn't trigger a module load (e.g. ioctl(TCGETS)).  Stephen
>> Smalley suggested the problem may lie in commit 44c02a2c3dc5
>> ("dev_ioctl(): move copyin/copyout to callers") which moves changes
>> the network dev_ioctl() function to always call dev_load(),
>> regardless of the requested ioctl.
>>
>> This patch moves the dev_load() calls back into the individual ioctls
>> while preserving the rest of the original patch.
>>
>> Reported-by: Dominick Grift <dac.override-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
>> Suggested-by: Stephen Smalley <sds-+05T5uksL2qpZYMLLGbcSA@public.gmane.org>
>> Signed-off-by: Paul Moore <paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org>
>> ---
>>  net/core/dev_ioctl.c |    7 +++++--
>>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> In the interest of full disclosure, I've compiled this code but I
> haven't booted it yet (test kernel building now).  I just wanted to
> post this sooner rather than later in case the networking folks, or
> Al, had a different solution they would prefer.

This is definitely the right fix, so patch applied.

Taking the dev_load() out of that switch statement definitely has
side effects.

WARNING: multiple messages have this Message-ID (diff)
From: David Miller <davem@davemloft.net>
To: paul@paul-moore.com
Cc: pmoore@redhat.com, netdev@vger.kernel.org,
	viro@zeniv.linux.org.uk, dac.override@gmail.com,
	selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org
Subject: Re: [PATCH] net: don't unnecessarily load kernel modules in dev_ioctl()
Date: Wed, 07 Mar 2018 15:13:32 -0500 (EST)	[thread overview]
Message-ID: <20180307.151332.565301474495395127.davem@davemloft.net> (raw)
In-Reply-To: <CAHC9VhR4FzwsAEO9O9Pnpkm2jOBajwZUkn_i0FqOMR_4ycag2g@mail.gmail.com>

From: Paul Moore <paul@paul-moore.com>
Date: Tue, 6 Mar 2018 17:32:47 -0500

> On Tue, Mar 6, 2018 at 5:27 PM, Paul Moore <pmoore@redhat.com> wrote:
>> From: Paul Moore <paul@paul-moore.com>
>>
>> Starting with v4.16-rc1 we've been seeing a higher than usual number
>> of requests for the kernel to load networking modules, even on events
>> which shouldn't trigger a module load (e.g. ioctl(TCGETS)).  Stephen
>> Smalley suggested the problem may lie in commit 44c02a2c3dc5
>> ("dev_ioctl(): move copyin/copyout to callers") which moves changes
>> the network dev_ioctl() function to always call dev_load(),
>> regardless of the requested ioctl.
>>
>> This patch moves the dev_load() calls back into the individual ioctls
>> while preserving the rest of the original patch.
>>
>> Reported-by: Dominick Grift <dac.override@gmail.com>
>> Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>> ---
>>  net/core/dev_ioctl.c |    7 +++++--
>>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> In the interest of full disclosure, I've compiled this code but I
> haven't booted it yet (test kernel building now).  I just wanted to
> post this sooner rather than later in case the networking folks, or
> Al, had a different solution they would prefer.

This is definitely the right fix, so patch applied.

Taking the dev_load() out of that switch statement definitely has
side effects.

WARNING: multiple messages have this Message-ID (diff)
From: davem@davemloft.net (David Miller)
To: linux-security-module@vger.kernel.org
Subject: [PATCH] net: don't unnecessarily load kernel modules in dev_ioctl()
Date: Wed, 07 Mar 2018 15:13:32 -0500 (EST)	[thread overview]
Message-ID: <20180307.151332.565301474495395127.davem@davemloft.net> (raw)
In-Reply-To: <CAHC9VhR4FzwsAEO9O9Pnpkm2jOBajwZUkn_i0FqOMR_4ycag2g@mail.gmail.com>

From: Paul Moore <paul@paul-moore.com>
Date: Tue, 6 Mar 2018 17:32:47 -0500

> On Tue, Mar 6, 2018 at 5:27 PM, Paul Moore <pmoore@redhat.com> wrote:
>> From: Paul Moore <paul@paul-moore.com>
>>
>> Starting with v4.16-rc1 we've been seeing a higher than usual number
>> of requests for the kernel to load networking modules, even on events
>> which shouldn't trigger a module load (e.g. ioctl(TCGETS)).  Stephen
>> Smalley suggested the problem may lie in commit 44c02a2c3dc5
>> ("dev_ioctl(): move copyin/copyout to callers") which moves changes
>> the network dev_ioctl() function to always call dev_load(),
>> regardless of the requested ioctl.
>>
>> This patch moves the dev_load() calls back into the individual ioctls
>> while preserving the rest of the original patch.
>>
>> Reported-by: Dominick Grift <dac.override@gmail.com>
>> Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>> ---
>>  net/core/dev_ioctl.c |    7 +++++--
>>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> In the interest of full disclosure, I've compiled this code but I
> haven't booted it yet (test kernel building now).  I just wanted to
> post this sooner rather than later in case the networking folks, or
> Al, had a different solution they would prefer.

This is definitely the right fix, so patch applied.

Taking the dev_load() out of that switch statement definitely has
side effects.
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

  parent reply	other threads:[~2018-03-07 20:13 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-06 22:27 [PATCH] net: don't unnecessarily load kernel modules in dev_ioctl() Paul Moore
2018-03-06 22:27 ` Paul Moore
2018-03-06 22:27 ` Paul Moore
2018-03-06 22:32 ` Paul Moore
2018-03-06 22:32   ` Paul Moore
2018-03-06 22:32   ` Paul Moore
     [not found]   ` <CAHC9VhR4FzwsAEO9O9Pnpkm2jOBajwZUkn_i0FqOMR_4ycag2g-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2018-03-07 20:13     ` David Miller [this message]
2018-03-07 20:13       ` David Miller
2018-03-07 20:13       ` David Miller
2018-03-06 23:59 ` Stephen Hemminger
2018-03-06 23:59   ` Stephen Hemminger
2018-03-06 23:59   ` Stephen Hemminger
2018-03-07 13:46   ` Paul Moore
2018-03-07 13:46     ` Paul Moore
2018-03-07 13:46     ` Paul Moore
2018-03-08 17:34   ` David Miller
2018-03-08 17:34     ` David Miller
2018-03-08 17:34     ` David Miller
     [not found]     ` <20180308.123440.2224695014753871221.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2018-03-08 18:05       ` Eric Dumazet
2018-03-08 18:05         ` Eric Dumazet
2018-03-08 18:05         ` Eric Dumazet
     [not found]         ` <c2d378b6-80b3-d9e1-7087-95f143875067-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2018-03-08 18:11           ` David Miller
2018-03-08 18:11             ` David Miller
2018-03-08 18:11             ` David Miller
     [not found]             ` <20180308.131115.611191617522587758.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2018-03-08 20:53               ` Eric Dumazet
2018-03-08 20:53                 ` Eric Dumazet
2018-03-08 20:53                 ` Eric Dumazet

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180307.151332.565301474495395127.davem@davemloft.net \
    --to=davem-ft/pcqaiutieiz0/mpfg9q@public.gmane.org \
    --cc=linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org \
    --cc=selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org \
    --cc=viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.