Received: by 2002:a25:1985:0:0:0:0:0 with SMTP id 127csp4463654ybz; Tue, 21 Apr 2020 00:45:29 -0700 (PDT) X-Google-Smtp-Source: APiQypLpf/qQ+tJsEhcSoyvfGLOehgFN0fU3J1H6Nyyex46F7SUSuyTzcGMbvM3VINNciZY6z0LT X-Received: by 2002:a05:6402:206f:: with SMTP id bd15mr8076585edb.24.1587455129508; Tue, 21 Apr 2020 00:45:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1587455129; cv=none; d=google.com; s=arc-20160816; b=fY9p3sqTa4XdmfVZYrRVOiFGSyjengcCIzhJ2wVE/qsn7Ybig1xKEHQmr3saUkjAtJ 3/BNMV5+m2W3TOfdzVnPWFFc7ZLDifIs7TPLmAYRGyPLvzo/d6h22t56+VrFBJTc1xxn t4gSBf2Kuwx3uDZ/SxZVzmnm61ua4SGy7e9HXEFdYdOVZz1Djbe+n0lRa2ZAM+mFnGVw /HVBcNGjSe6lBPoaEwvqx55H+10QBnncpfkPX96rPSK2OJBz9G9z3FEtJNXdnA61Z+wf CvRzdOYnPx7zCp6qwj5sxoo8yzXfMuLH7skNY3swfig69aulKHTKlMRm+K2agAjLaC4w ABQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=7ZSmzJnYeNrMfWBq2k9O678hPyRVSl36UR1wN6CUCUg=; b=jQJl/XULd8Q7aD0Zd1p5f3EsV4i6407iWXmUcLm9iseqf4KwAIxY1uisjtz1tvFFGz EMnDD9wiQb7z/wrXo0enEIHYa8wlCPiNzqMCyRujq5+ikfz0EkQlXT2ubExLK+3oC5os 6qUyXF+hdl+TitCDsV6cbfQpgMErlXuwjI+JFVsVoV6CwitjfY3mhRNjfK04ZdnnmUHN FRmCJ5Oya1H44bHc5dI9OtExDAPoB2uRMld9KCr96xMt9DCr3qY6shCDrVODfofwTUGq aBdktOANdHN7CK8npZAkxS0mGt5/fzrl2SoMS7uA6bRfmYJRkv8XXdItC6AZoDDNJSvN 4/Ng== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id g14si653362eje.287.2020.04.21.00.45.07; Tue, 21 Apr 2020 00:45:29 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728314AbgDUHmu (ORCPT + 99 others); Tue, 21 Apr 2020 03:42:50 -0400 Received: from verein.lst.de ([213.95.11.211]:45118 "EHLO verein.lst.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728233AbgDUHms (ORCPT ); Tue, 21 Apr 2020 03:42:48 -0400 Received: by verein.lst.de (Postfix, from userid 2407) id 1C8B568CEC; Tue, 21 Apr 2020 09:42:42 +0200 (CEST) Date: Tue, 21 Apr 2020 09:42:41 +0200 From: Christoph Hellwig To: Matthew Wilcox Cc: Christoph Hellwig , Kees Cook , Iurii Zaikin , Luis Chamberlain , Greg Kroah-Hartman , "Rafael J. Wysocki" , Alexei Starovoitov , Daniel Borkmann , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org Subject: Re: [PATCH 6/6] sysctl: pass kernel pointers to ->proc_handler Message-ID: <20200421074241.GB15772@lst.de> References: <20200417064146.1086644-1-hch@lst.de> <20200417064146.1086644-7-hch@lst.de> <20200417181718.GN5820@bombadil.infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200417181718.GN5820@bombadil.infradead.org> User-Agent: Mutt/1.5.17 (2007-11-01) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Apr 17, 2020 at 11:17:18AM -0700, Matthew Wilcox wrote: > > if (error) > > - goto out; > > + goto out_free_buf; > > > > /* careful: calling conventions are nasty here */ > > I think this comment can go now ;-) It actually long predates the set_fs that was only added for BPF, and goes back to: 330d57fb98a91 ("[PATCH] Fix sysctl unregistration oops (CVE-2005-2709)") in the history.git tree. > > - } else { > > - error = table->proc_handler(table, write, buf, &count, ppos); > > - } > > + error = table->proc_handler(table, write, kbuf, &count, ppos); > > + if (error) > > + goto out_free_buf; > > + > > + error = -EFAULT; > > + if (copy_to_user(ubuf, kbuf, count)) > > + goto out_free_buf; > > Can we skip this if !write? Indeed, don't we have to in case the user has > passed a pointer to a read-only memory page? Indeed.