From: Alexander Viro <aviro@redhat.com>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-arch <linux-arch@vger.kernel.org>,
Kees Cook <keescook@chromium.org>,
Alexander Viro <aviro@redhat.com>,
the arch/x86 maintainers <x86@kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Alexey Dobriyan <adobriyan@gmail.com>,
Eric Biggers <ebiggers@kernel.org>,
Luis Chamberlain <mcgrof@kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
linuxppc-dev <linuxppc-dev@lists.ozlabs.org>,
Christoph Hellwig <hch@lst.de>
Subject: Re: [PATCH 05/14] fs: don't allow kernel reads and writes without iter ops
Date: Sat, 10 Oct 2020 01:55:24 +0000 [thread overview]
Message-ID: <20201010015524.GB101464@shell-el7.hosts.prod.upshift.rdu2.redhat.com> (raw)
In-Reply-To: <CAHk-=wigvcmp-jcgoNCbx45W7j3=0jA320CfpskwuoEjefM7nQ@mail.gmail.com>
On Fri, Oct 09, 2020 at 06:29:13PM -0700, Linus Torvalds wrote:
> On Fri, Oct 9, 2020 at 6:19 PM Eric Biggers <ebiggers@kernel.org> wrote:
> >
> > Okay, that makes more sense. So the patchset from Matthew
> > https://lkml.kernel.org/linux-fsdevel/20201003025534.21045-1-willy@infradead.org/T/#u
> > isn't what you had in mind.
>
> No.
>
> That first patch makes sense - it's just the "ppos can be NULL" patch.
>
> But as mentioned, NULL isn't "shorthand for zero". It's just "pipes
> don't _have_ a pos, trying to pass in some explicit position is
> crazy".
>
> So no, the other patches in that set are a bit odd, I think.
>
> SOME of them look potentially fine - the bpfilter one seems to be
> valid, for example, because it's literally about reading/writing a
> pipe. And maybe the sysctl one is similarly sensible - I didn't check
> the context of that one.
FWIW, I hadn't pushed that branch out (or merged it into #for-next yet);
for one thing, uml part (mconsole) is simply broken, for another...
IMO ##5--8 are asking for kernel_pread() and if you look at binfmt_elf.c,
you'll see elf_read() being pretty much that. acct.c, keys and usermode
parts are asking for kernel_pwrite() as well.
I've got stuck looking through the drivers/target stuff - it would've
been another kernel_pwrite() candidate, but it smells like its use of
filp_open() is really asking for trouble, starting with symlink attacks.
Not sure - I'm not familiar with the area, but...
next prev parent reply other threads:[~2020-10-10 2:05 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-03 14:22 remove the last set_fs() in common code, and remove it for x86 and powerpc v3 Christoph Hellwig
2020-09-03 14:22 ` [PATCH 01/14] proc: remove a level of indentation in proc_get_inode Christoph Hellwig
2020-09-03 14:22 ` [PATCH 02/14] proc: cleanup the compat vs no compat file ops Christoph Hellwig
2020-09-03 14:22 ` [PATCH 03/14] proc: add a read_iter method to proc proc_ops Christoph Hellwig
2020-09-03 14:22 ` [PATCH 04/14] sysctl: Convert to iter interfaces Christoph Hellwig
2020-09-03 14:22 ` [PATCH 05/14] fs: don't allow kernel reads and writes without iter ops Christoph Hellwig
2020-10-01 22:38 ` Eric Biggers
2020-10-01 22:40 ` Al Viro
2020-10-02 16:27 ` Linus Torvalds
2020-10-09 22:06 ` Eric Biggers
2020-10-10 1:03 ` Linus Torvalds
2020-10-10 1:19 ` Eric Biggers
2020-10-10 1:29 ` Linus Torvalds
2020-10-10 1:55 ` Alexander Viro [this message]
2020-10-14 5:51 ` Christoph Hellwig
2020-09-03 14:22 ` [PATCH 06/14] fs: don't allow splice read/write without explicit ops Christoph Hellwig
2020-09-03 14:22 ` [PATCH 07/14] uaccess: add infrastructure for kernel builds with set_fs() Christoph Hellwig
2020-09-03 14:22 ` [PATCH 08/14] test_bitmap: remove user bitmap tests Christoph Hellwig
2020-09-03 14:22 ` [PATCH 09/14] lkdtm: remove set_fs-based tests Christoph Hellwig
2020-09-03 14:22 ` [PATCH 10/14] x86: move PAGE_OFFSET, TASK_SIZE & friends to page_{32, 64}_types.h Christoph Hellwig
2020-09-03 14:22 ` [PATCH 11/14] x86: make TASK_SIZE_MAX usable from assembly code Christoph Hellwig
2020-09-03 14:22 ` [PATCH 12/14] x86: remove address space overrides using set_fs() Christoph Hellwig
2020-09-03 21:30 ` David Laight
2020-09-03 23:25 ` Linus Torvalds
2020-09-04 7:59 ` David Laight
2020-09-04 2:55 ` Al Viro
2020-09-04 4:41 ` Al Viro
2020-09-04 6:38 ` Christoph Hellwig
2020-09-04 7:47 ` Christoph Hellwig
2020-09-03 14:22 ` [PATCH 13/14] powerpc: use non-set_fs based maccess routines Christoph Hellwig
2020-09-03 14:22 ` [PATCH 14/14] powerpc: remove address space overrides using set_fs() Christoph Hellwig
2020-09-03 15:43 ` Christophe Leroy
2020-09-03 15:49 ` Christoph Hellwig
2020-09-03 15:56 ` Christoph Hellwig
2020-09-03 16:03 ` Christophe Leroy
2020-09-03 14:28 ` remove the last set_fs() in common code, and remove it for x86 and powerpc v3 Al Viro
2020-09-03 14:30 ` Christoph Hellwig
2020-09-03 14:36 ` Al Viro
2020-09-03 14:40 ` Christoph Hellwig
2020-09-09 17:31 ` Linus Torvalds
2020-09-09 18:40 ` Segher Boessenkool
2020-09-09 21:33 ` Linus Torvalds
2020-09-10 8:04 ` David Laight
2020-09-10 8:13 ` Christophe Leroy
2020-09-10 9:26 ` David Laight
2020-09-10 12:26 ` David Laight
2020-09-10 15:20 ` Segher Boessenkool
2020-09-10 15:31 ` David Laight
2020-09-10 17:15 ` Segher Boessenkool
2020-09-10 15:16 ` Segher Boessenkool
2020-09-10 15:44 ` Segher Boessenkool
2020-09-03 15:49 ` Linus Torvalds
2020-09-04 6:00 ` Ingo Molnar
2020-09-04 17:58 ` Alexey Dobriyan
2020-09-04 18:42 ` Linus Torvalds
2020-09-04 21:01 ` David Laight
2020-09-05 7:16 ` Christophe Leroy
2020-09-05 10:13 ` David Laight
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201010015524.GB101464@shell-el7.hosts.prod.upshift.rdu2.redhat.com \
--to=aviro@redhat.com \
--cc=adobriyan@gmail.com \
--cc=ebiggers@kernel.org \
--cc=hch@lst.de \
--cc=keescook@chromium.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mcgrof@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).