Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Sat, 27 Feb 2021 09:41:36 -0500
From:   "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
Subject: Re: [PATCH] proc_sysctl: clamp sizes using table->maxlen
To:     Christoph Hellwig <hch@lst.de>
Cc:     Alexey Dobriyan <adobriyan@gmail.com>,
        Kees Cook <keescook@chromium.org>,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        Luis Chamberlain <mcgrof@kernel.org>,
        Andrey Ignatov <rdna@fb.com>,
        Al Viro <viro@zeniv.linux.org.uk>,
        Iurii Zaikin <yzaikin@google.com>
References: <20210215145305.283064-1-alex_y_xu.ref@yahoo.ca>
        <20210215145305.283064-1-alex_y_xu@yahoo.ca> <20210216084728.GA23731@lst.de>
In-Reply-To: <20210216084728.GA23731@lst.de>
MIME-Version: 1.0
Message-Id: <1614436629.aqa2hys64t.none@localhost>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Length: 955
Precedence: bulk

Excerpts from Christoph Hellwig's message of February 16, 2021 3:47 am:
> How do these maxlen =3D 0 entries even survive the sysctl_check_table
> check?

maxlen!=3D0 is only checked for "default" handlers, e.g. proc_dostring,=20
proc_dointvec. it is not checked for non-default handlers, because some=20
of them use fixed lengths.

my patch is not correct though because some drivers neither set proper=20
maxlen nor use memcpy themselves; instead, they construct a ctl_table on=20
the stack and call proc_*.

> Please split this into one patch each each subsystem that sets maxlen
> to 0 and the actual change to proc_sysctl.c.

I will do this with a new patch version once I figure out a way to=20
comprehensively fix all the drivers setting bogus values for maxlen=20
(sometimes maxlen=3D0 is valid if only blank writes are permitted, and=20
some drivers set random values which have no relation to the actual read=20
size).

Thank you for the review.