From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97B91C55181 for ; Tue, 21 Apr 2020 07:42:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 67B7D2084D for ; Tue, 21 Apr 2020 07:42:48 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 67B7D2084D Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=lst.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EDCEE8E0007; Tue, 21 Apr 2020 03:42:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E8E0E8E0005; Tue, 21 Apr 2020 03:42:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DA2148E0007; Tue, 21 Apr 2020 03:42:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0141.hostedemail.com [216.40.44.141]) by kanga.kvack.org (Postfix) with ESMTP id C4D6B8E0005 for ; Tue, 21 Apr 2020 03:42:47 -0400 (EDT) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 8457A52AD for ; Tue, 21 Apr 2020 07:42:47 +0000 (UTC) X-FDA: 76731070374.17.wave47_8cba393690e41 X-HE-Tag: wave47_8cba393690e41 X-Filterd-Recvd-Size: 2189 Received: from verein.lst.de (verein.lst.de [213.95.11.211]) by imf46.hostedemail.com (Postfix) with ESMTP for ; Tue, 21 Apr 2020 07:42:46 +0000 (UTC) Received: by verein.lst.de (Postfix, from userid 2407) id 1C8B568CEC; Tue, 21 Apr 2020 09:42:42 +0200 (CEST) Date: Tue, 21 Apr 2020 09:42:41 +0200 From: Christoph Hellwig To: Matthew Wilcox Cc: Christoph Hellwig , Kees Cook , Iurii Zaikin , Luis Chamberlain , Greg Kroah-Hartman , "Rafael J. Wysocki" , Alexei Starovoitov , Daniel Borkmann , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org Subject: Re: [PATCH 6/6] sysctl: pass kernel pointers to ->proc_handler Message-ID: <20200421074241.GB15772@lst.de> References: <20200417064146.1086644-1-hch@lst.de> <20200417064146.1086644-7-hch@lst.de> <20200417181718.GN5820@bombadil.infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200417181718.GN5820@bombadil.infradead.org> User-Agent: Mutt/1.5.17 (2007-11-01) X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Apr 17, 2020 at 11:17:18AM -0700, Matthew Wilcox wrote: > > if (error) > > - goto out; > > + goto out_free_buf; > > > > /* careful: calling conventions are nasty here */ > > I think this comment can go now ;-) It actually long predates the set_fs that was only added for BPF, and goes back to: 330d57fb98a91 ("[PATCH] Fix sysctl unregistration oops (CVE-2005-2709)") in the history.git tree. > > - } else { > > - error = table->proc_handler(table, write, buf, &count, ppos); > > - } > > + error = table->proc_handler(table, write, kbuf, &count, ppos); > > + if (error) > > + goto out_free_buf; > > + > > + error = -EFAULT; > > + if (copy_to_user(ubuf, kbuf, count)) > > + goto out_free_buf; > > Can we skip this if !write? Indeed, don't we have to in case the user has > passed a pointer to a read-only memory page? Indeed.