From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B36A2C433DF for ; Wed, 24 Jun 2020 06:05:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 89B6520781 for ; Wed, 24 Jun 2020 06:05:16 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qJ6Eku5d" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388307AbgFXGFQ (ORCPT ); Wed, 24 Jun 2020 02:05:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57576 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388164AbgFXGFP (ORCPT ); Wed, 24 Jun 2020 02:05:15 -0400 Received: from mail-lj1-x244.google.com (mail-lj1-x244.google.com [IPv6:2a00:1450:4864:20::244]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B9964C061573; Tue, 23 Jun 2020 23:05:14 -0700 (PDT) Received: by mail-lj1-x244.google.com with SMTP id s9so1203500ljm.11; Tue, 23 Jun 2020 23:05:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=+Z9fHqLXgOm0n7UmLwNeJuv67f0+a+SBVV6ekUy68zA=; b=qJ6Eku5d6gECfuQ94hQXns5OO86tzVV2pqEvzmKJ0KomNU5LsF4ahTasNh64btfXKz 3EwVn7gvhX2LLmC8v25xUrpfjtOIyKvLSlNIu4BwHc3bBkjZefe8+15Bb3+iK9N/vybH Ghz7A+r8pLCwYx5cPY5wP3W4jdNyeFXje1ZgmAeIcJy4KwjjL5waK0Rmh4zORDuNbWNP b5DU9aXAAUYbzmOTMCpUbsEj2rlZI/u8vuQtP5dU8HPFxcfniVMaWPqwo9UIHDhGKrkJ eWsyCpj1JqPI1rpibwbHOep40NeVor/D5oAONUc4tr2qNHFLlLq4izCtIQKQiJJ491nL xbWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=+Z9fHqLXgOm0n7UmLwNeJuv67f0+a+SBVV6ekUy68zA=; b=QWmwPsZ5kuTOTSlW8K7RWjkwsy1g2QxE+KAUgnU0nGwjs1vLgrfJiJDLZ86n/mSNoo 3xcw8kAJAcfhIWantvZ55w9ztfC6G19Ay4W6XwL/ejhmJ/ICJM+ZEI+qgcWROtIuFCNn Gcg4j0NDftS5IZzBEblzCwr4GWZ2L/by1IXrbC0bXGh29mdHvhpkSa99eU4QqsAVLni9 iqo1G0ePv5z9F1EEAeEe7Tz5E/2KJl+Az0XBZLo/vLerSaulrObSkro81T3e8+NFqA3c iEGxIUvGGV44S0tt7iiZeVO+Hgekmcqk2uaIZzyuTLJBc5g3T7uiyokMNfI6bzPUajA1 gpQw== X-Gm-Message-State: AOAM533lN0L5OqNRbMRqQTXTBlEaeW3fVclkro2mDXi/Y8+8UAc/lwws mPPIxXLtkLUVY3k6oiobkerIRoUTjaKpS0TeqpE= X-Google-Smtp-Source: ABdhPJxqPlf/lTh0R1Ca3j88H5bteQmLx3S3FiVVu9nOE9VS2aFOA7ixS8lo0Afl9WruUIvclfNhiLECmXQ9MJ0thzE= X-Received: by 2002:a05:651c:1193:: with SMTP id w19mr13420938ljo.121.1592978713104; Tue, 23 Jun 2020 23:05:13 -0700 (PDT) MIME-Version: 1.0 References: <87bllngirv.fsf@x220.int.ebiederm.org> <87ftaxd7ky.fsf@x220.int.ebiederm.org> <20200616015552.isi6j5x732okiky4@ast-mbp.dhcp.thefacebook.com> <87h7v1pskt.fsf@x220.int.ebiederm.org> <20200623183520.5e7fmlt3omwa2lof@ast-mbp.dhcp.thefacebook.com> <87h7v1mx4z.fsf@x220.int.ebiederm.org> <20200623194023.lzl34qt2wndhcehk@ast-mbp.dhcp.thefacebook.com> <20200624040054.x5xzkuhiw67cywzl@ast-mbp.dhcp.thefacebook.com> In-Reply-To: <20200624040054.x5xzkuhiw67cywzl@ast-mbp.dhcp.thefacebook.com> From: Alexei Starovoitov Date: Tue, 23 Jun 2020 23:05:00 -0700 Message-ID: Subject: Re: [RFC][PATCH] net/bpfilter: Remove this broken and apparently unmantained To: Tetsuo Handa Cc: "Eric W. Biederman" , Linus Torvalds , Kees Cook , Andrew Morton , Alexei Starovoitov , David Miller , Al Viro , bpf , linux-fsdevel , Daniel Borkmann , Jakub Kicinski , Masahiro Yamada , Gary Lin , Bruno Meneguele Content-Type: text/plain; charset="UTF-8" Sender: bpf-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org On Tue, Jun 23, 2020 at 9:00 PM Alexei Starovoitov wrote: > > On Wed, Jun 24, 2020 at 10:51:15AM +0900, Tetsuo Handa wrote: > > On 2020/06/24 4:40, Alexei Starovoitov wrote: > > > There is no refcnt bug. It was a user error on tomoyo side. > > > fork_blob() works as expected. > > > > Absolutely wrong! Any check which returns an error during current->in_execve == 1 > > will cause this refcnt bug. You are simply ignoring that there is possibility > > that execve() fails. > > you mean security_bprm_creds_for_exec() denying exec? > hmm. got it. refcnt model needs to change then. I think the following trivial change should do it: diff --git a/kernel/umh.c b/kernel/umh.c index 79f139a7ca03..f80dd2a93ca4 100644 --- a/kernel/umh.c +++ b/kernel/umh.c @@ -512,7 +512,9 @@ int fork_usermode_blob(void *data, size_t len, struct umh_info *info) file = shmem_kernel_file_setup("", len, 0); if (IS_ERR(file)) return PTR_ERR(file); - + err = deny_write_access(file); + if (err) + goto out_fput; written = kernel_write(file, data, len, &pos); if (written != len) { err = written; @@ -532,8 +534,11 @@ int fork_usermode_blob(void *data, size_t len, struct umh_info *info) mutex_lock(&umh_list_lock); list_add(&info->list, &umh_list); mutex_unlock(&umh_list_lock); + return 0; } out: + allow_write_access(file); +out_fput: fput(file); return err; } I'll do more tests tomorrow and send it with SOB.