From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10C5EC433DB for ; Sun, 7 Feb 2021 22:47:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C73BD64DC3 for ; Sun, 7 Feb 2021 22:47:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229629AbhBGWqE (ORCPT ); Sun, 7 Feb 2021 17:46:04 -0500 Received: from mx2.suse.de ([195.135.220.15]:51000 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229506AbhBGWqB (ORCPT ); Sun, 7 Feb 2021 17:46:01 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 229C2AD24; Sun, 7 Feb 2021 22:45:20 +0000 (UTC) From: NeilBrown To: Andrew Morton Date: Mon, 08 Feb 2021 09:45:09 +1100 Cc: Alexander Viro , Jonathan Corbet , Xin Long , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, Ingo Molnar , Dave Hansen , Andy Lutomirski , Peter Zijlstra , Vlad Yasevich , Neil Horman , Marcelo Ricardo Leitner , "David S. Miller" , linux-sctp@vger.kernel.org, netdev@vger.kernel.org Subject: Re: [PATCH 0/3] Fix some seq_file users that were recently broken In-Reply-To: <20210205143550.58d3530918459eafa918ad0c@linux-foundation.org> References: <161248518659.21478.2484341937387294998.stgit@noble1> <20210205143550.58d3530918459eafa918ad0c@linux-foundation.org> Message-ID: <87ft27ebuy.fsf@notabene.neil.brown.name> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Fri, Feb 05 2021, Andrew Morton wrote: > On Fri, 05 Feb 2021 11:36:30 +1100 NeilBrown wrote: > >> A recent change to seq_file broke some users which were using seq_file >> in a non-"standard" way ... though the "standard" isn't documented, so >> they can be excused. The result is a possible leak - of memory in one >> case, of references to a 'transport' in the other. >>=20 >> These three patches: >> 1/ document and explain the problem >> 2/ fix the problem user in x86 >> 3/ fix the problem user in net/sctp >>=20 > > 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code and > interface") was August 2018, so I don't think "recent" applies here? I must be getting old :-( > > I didn't look closely, but it appears that the sctp procfs file is > world-readable. So we gave unprivileged userspace the ability to leak > kernel memory? Not quite that bad. The x86 problem allows arbitrary memory to be leaked, but that is in debugfs (as I'm sure you saw) so is root-only. The sctp one only allows an sctp_transport to be pinned. That is not good and would, e.g., prevent the module from being unloaded. But unlike a simple memory leak it won't affect anything outside of sctp. > > So I'm thinking that we aim for 5.12-rc1 on all three patches with a cc:s= table? Thanks for looking after these! NeilBrown --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQJCBAEBCAAsFiEEG8Yp69OQ2HB7X0l6Oeye3VZigbkFAmAgbXYOHG5laWxiQHN1 c2UuZGUACgkQOeye3VZigbmRIw/+L3opkKLyG2Hn5LtKCl8TV5atFOVnkNdg4u1/ N7vs18opY/vMHwel8DJX3FKF1nZeiZVan1cUox774eoWmFjni/IGrVU9HjVowJhc zHqv17t60IuxAWl4YAYu1SEryAgLMtX6OlqJVrjQ1WRpMEqWN14SgJ2qbuQQW3Fp zuCEaR5/MMmWfHtVxthrlmqrPO4DdULJWd54S+OR9AdBTJ5iTP6GqbiT6E5500am DMlL9oaymdwILGK339a97BDkvo/GcXiU4I9Netwsn+dhE+iM0A6nfdpR2S+UkbLE fqIC4ICia5Cdd04cuMQxqjDqKqgWoj6q+j5BisfXu+VryUWPp+IKLJnljJ3HKOo1 8HZ4M4ldc2c2fo0BZy8qLgld2Ky9yWfkWvFxD91fdLoW862hb4QSORaqeuOHCCxy TFEgOfgEXRS0y1YP1ue1TkvBCMlFlRQ/y4b0b7PKLcZmbQ8gZP/ZLtMcPVxS+uiW WtqvP8ED9uSbmDgZKWrkId0XN2qd/N2VeDqqaHLEm3AYBYKe6sjNRq/P2XhaJgvg fwgFf5HWbWRwpgdLtSpFdwobSZJoSfoqWPGfHw9qnldXXbLSuDrEHIFRywNCHODl SpL40dXvgMrkDtHYK7C9V7xPMCj9Ja0dnSR2KJQOJnWXw4NnHUXbVAf7VP+5MqpD WJxmMU8= =Gd5p -----END PGP SIGNATURE----- --=-=-=--