Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210416192413.1514419-1-eric.dumazet@gmail.com>
 <CAHk-=wjbvzCAhAtvG0d81W5o0-KT5PPTHhfJ5ieDFq+bGtgOYg@mail.gmail.com> <CAHk-=wgdyusj4Sz6zVOGvD8pNiYmPik3t4-o0TXB9cTUgz_0uw@mail.gmail.com>
In-Reply-To: <CAHk-=wgdyusj4Sz6zVOGvD8pNiYmPik3t4-o0TXB9cTUgz_0uw@mail.gmail.com>
From:   Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat, 17 Apr 2021 09:27:04 -0700
Message-ID: <CAHk-=wjYVZZpqDGH2Q=kMOyOqBhpbt8t8JdEWZHDGrPiV=_ifA@mail.gmail.com>
Subject: Re: [PATCH] x86/uaccess: small optimization in unsafe_copy_to_user()
To:     Eric Dumazet <eric.dumazet@gmail.com>,
        Al Viro <viro@zeniv.linux.org.uk>
Cc:     Thomas Gleixner <tglx@linutronix.de>,
        linux-kernel <linux-kernel@vger.kernel.org>,
        Eric Dumazet <edumazet@google.com>
Content-Type: multipart/mixed; boundary="00000000000014ade305c02d9269"
Precedence: bulk

--00000000000014ade305c02d9269
Content-Type: text/plain; charset="UTF-8"

On Sat, Apr 17, 2021 at 9:08 AM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> Side note: I'm, looking at the readdir cases that I wrote, and I have
> to just say that is broken too. So "stones and glass houses" etc, and
> I'll have to fix that too.

In particular, the very very old OLD_READDIR interface that only fills
in one dirent at a time didn't call verify_dirent_name(). Same for the
compat version.

This requires a corrupt filesystem to be an issue (and even then,
most/all would have the length of a directory entry in an 'unsigned
char', so even corrupt filesystems would generally never have a
negative name length).

So I don't think it's an issue in _practice_, but at the same time it
is very much an example of the same issue that put_cmsg() has in
net-next: unsafe user copies should be fully guarded and not have some
"but this would never happen because callers would never do anything
bad".

Al - fairly trivial patch applied, comments?

             Linus

--00000000000014ade305c02d9269
Content-Type: text/x-patch; charset="US-ASCII"; name="patch.diff"
Content-Disposition: attachment; filename="patch.diff"
Content-Transfer-Encoding: base64
Content-ID: <f_knlybvem0>
X-Attachment-Id: f_knlybvem0

IGZzL3JlYWRkaXIuYyB8IDYgKysrKysrCiAxIGZpbGUgY2hhbmdlZCwgNiBpbnNlcnRpb25zKCsp
CgpkaWZmIC0tZ2l0IGEvZnMvcmVhZGRpci5jIGIvZnMvcmVhZGRpci5jCmluZGV4IDE5NDM0YjNj
OTgyYy4uMDllOGVkN2Q0MTYxIDEwMDY0NAotLS0gYS9mcy9yZWFkZGlyLmMKKysrIGIvZnMvcmVh
ZGRpci5jCkBAIC0xNTAsNiArMTUwLDkgQEAgc3RhdGljIGludCBmaWxsb25lZGlyKHN0cnVjdCBk
aXJfY29udGV4dCAqY3R4LCBjb25zdCBjaGFyICpuYW1lLCBpbnQgbmFtbGVuLAogCiAJaWYgKGJ1
Zi0+cmVzdWx0KQogCQlyZXR1cm4gLUVJTlZBTDsKKwlidWYtPnJlc3VsdCA9IHZlcmlmeV9kaXJl
bnRfbmFtZShuYW1lLCBuYW1sZW4pOworCWlmIChidWYtPnJlc3VsdCA8IDApCisJCXJldHVybiBi
dWYtPnJlc3VsdDsKIAlkX2lubyA9IGlubzsKIAlpZiAoc2l6ZW9mKGRfaW5vKSA8IHNpemVvZihp
bm8pICYmIGRfaW5vICE9IGlubykgewogCQlidWYtPnJlc3VsdCA9IC1FT1ZFUkZMT1c7CkBAIC00
MDUsNiArNDA4LDkgQEAgc3RhdGljIGludCBjb21wYXRfZmlsbG9uZWRpcihzdHJ1Y3QgZGlyX2Nv
bnRleHQgKmN0eCwgY29uc3QgY2hhciAqbmFtZSwKIAogCWlmIChidWYtPnJlc3VsdCkKIAkJcmV0
dXJuIC1FSU5WQUw7CisJYnVmLT5yZXN1bHQgPSB2ZXJpZnlfZGlyZW50X25hbWUobmFtZSwgbmFt
bGVuKTsKKwlpZiAoYnVmLT5yZXN1bHQgPCAwKQorCQlyZXR1cm4gYnVmLT5yZXN1bHQ7CiAJZF9p
bm8gPSBpbm87CiAJaWYgKHNpemVvZihkX2lubykgPCBzaXplb2YoaW5vKSAmJiBkX2lubyAhPSBp
bm8pIHsKIAkJYnVmLT5yZXN1bHQgPSAtRU9WRVJGTE9XOwo=
--00000000000014ade305c02d9269--