From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: mzxreary@0pointer.de, linux-kernel@vger.kernel.org,
linux-crypto@vger.kernel.org
Subject: Re: [PATCH 1/2] sysctl: read() must consume poll events, not poll()
Date: Mon, 2 May 2022 17:30:24 +0200 [thread overview]
Message-ID: <Ym/5EEYHbk56hV1H@zx2c4.com> (raw)
In-Reply-To: <20220502140602.130373-1-Jason@zx2c4.com>
+Lennart, since systemd is the only userspace I know of currently making
use of this.
On Mon, May 02, 2022 at 04:06:01PM +0200, Jason A. Donenfeld wrote:
> Events that poll() responds to are supposed to be consumed when the file
> is read(), not by the poll() itself. By putting it on the poll() itself,
> it makes it impossible to poll() on a epoll file descriptor, since the
> event gets consumed too early. Jann wrote a PoC, available in the link
> below.
>
> Reported-by: Jann Horn <jannh@google.com>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Luis Chamberlain <mcgrof@kernel.org>
> Cc: linux-fsdevel@vger.kernel.org
> Link: https://lore.kernel.org/lkml/CAG48ez1F0P7Wnp=PGhiUej=u=8CSF6gpD9J=Oxxg0buFRqV1tA@mail.gmail.com/
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> ---
> fs/proc/proc_sysctl.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
> index 7d9cfc730bd4..1aa145794207 100644
> --- a/fs/proc/proc_sysctl.c
> +++ b/fs/proc/proc_sysctl.c
> @@ -622,6 +622,14 @@ static ssize_t proc_sys_call_handler(struct kiocb *iocb, struct iov_iter *iter,
>
> static ssize_t proc_sys_read(struct kiocb *iocb, struct iov_iter *iter)
> {
> + struct inode *inode = file_inode(iocb->ki_filp);
> + struct ctl_table_header *head = grab_header(inode);
> + struct ctl_table *table = PROC_I(inode)->sysctl_entry;
> +
> + if (!IS_ERR(head) && table->poll)
> + iocb->ki_filp->private_data = proc_sys_poll_event(table->poll);
> + sysctl_head_finish(head);
> +
> return proc_sys_call_handler(iocb, iter, 0);
> }
>
> @@ -668,10 +676,8 @@ static __poll_t proc_sys_poll(struct file *filp, poll_table *wait)
> event = (unsigned long)filp->private_data;
> poll_wait(filp, &table->poll->wait, wait);
>
> - if (event != atomic_read(&table->poll->event)) {
> - filp->private_data = proc_sys_poll_event(table->poll);
> + if (event != atomic_read(&table->poll->event))
> ret = EPOLLIN | EPOLLRDNORM | EPOLLERR | EPOLLPRI;
> - }
>
> out:
> sysctl_head_finish(head);
> --
> 2.35.1
Just wanted to double check with you that this change wouldn't break how
you're using it in systemd for /proc/sys/kernel/hostname:
https://github.com/systemd/systemd/blob/39cd62c30c2e6bb5ec13ebc1ecf0d37ed015b1b8/src/journal/journald-server.c#L1832
https://github.com/systemd/systemd/blob/39cd62c30c2e6bb5ec13ebc1ecf0d37ed015b1b8/src/resolve/resolved-manager.c#L465
I couldn't find anybody else actually polling on it. Interestingly, it
looks like sd_event_add_io uses epoll() inside, but you're not hitting
the bug that Jann pointed out (because I suppose you're not poll()ing on
an epoll fd).
Jason
next prev parent reply other threads:[~2022-05-02 15:30 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-02 14:06 [PATCH 1/2] sysctl: read() must consume poll events, not poll() Jason A. Donenfeld
2022-05-02 14:06 ` [PATCH 2/2] random: add fork_event sysctl for polling VM forks Jason A. Donenfeld
2022-05-02 15:40 ` Lennart Poettering
2022-05-02 16:12 ` Jason A. Donenfeld
2022-05-02 16:51 ` Lennart Poettering
2022-05-02 17:59 ` Alexander Graf
2022-05-02 18:29 ` Jason A. Donenfeld
2022-05-02 18:57 ` Alexander Graf
2022-05-02 20:03 ` Jason A. Donenfeld
2022-05-03 8:29 ` Lennart Poettering
2022-05-03 11:55 ` Jason A. Donenfeld
2022-05-03 12:33 ` Lennart Poettering
2022-05-02 18:04 ` Jason A. Donenfeld
2022-05-02 18:34 ` Alexander Graf
2022-05-02 18:46 ` Jason A. Donenfeld
2022-05-02 18:56 ` Alexander Graf
2022-05-02 19:27 ` Jason A. Donenfeld
2022-05-02 19:41 ` Alexander Graf
2022-05-04 15:45 ` Michael Kelley (LINUX)
2022-05-02 18:44 ` Jason A. Donenfeld
2022-05-03 7:42 ` Lennart Poettering
2022-05-03 9:08 ` Jason A. Donenfeld
2022-05-03 9:32 ` Lennart Poettering
2022-05-03 10:07 ` Jason A. Donenfeld
2022-05-03 12:42 ` Lennart Poettering
2022-05-11 0:40 ` Simo Sorce
2022-05-11 1:18 ` Jason A. Donenfeld
2022-05-11 12:59 ` Simo Sorce
2022-05-11 13:19 ` Alexander Graf
2022-05-11 13:19 ` Jason A. Donenfeld
2022-05-11 14:32 ` Simo Sorce
2022-05-11 13:20 ` Alexander Graf
2022-05-02 15:30 ` Jason A. Donenfeld [this message]
2022-05-02 15:43 ` [PATCH 1/2] sysctl: read() must consume poll events, not poll() Lennart Poettering
2022-05-03 11:27 ` Jason A. Donenfeld
2022-05-12 17:40 ` Luis Chamberlain
2022-05-12 18:29 ` Eric W. Biederman
2022-05-12 18:32 ` Jason A. Donenfeld
2022-05-12 18:22 ` Lucas De Marchi
2022-05-12 18:27 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Ym/5EEYHbk56hV1H@zx2c4.com \
--to=jason@zx2c4.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mzxreary@0pointer.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).