Received-SPF: pass (google.com: domain of linux-kernel+bounces-168047-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Fri, 3 May 2024 20:24:24 +0200 (GMT+02:00)
From: linux@weissschuh.net
To: Kees Cook <keescook@chromium.org>
Cc: =?UTF-8?Q?Thomas_Wei=C3=9Fschuh?= <linux@weissschuh.net>,
	Alexander Popov <alex.popov@linux.com>,
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
	stable@vger.kernel.org, Luis Chamberlain <mcgrof@kernel.org>,
	Joel Granados <j.granados@samsung.com>
Message-ID: <266bd6e1-d444-43f5-a98f-c7069819029b@weissschuh.net>
In-Reply-To: <202405031054.9FFA75B@keescook>
References: <20240503-sysctl-const-stackleak-v1-1-603fecb19170@weissschuh.net> <202405031054.9FFA75B@keescook>
Subject: Re: [PATCH] stackleak: don't modify ctl_table argument
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

May 3, 2024 19:55:37 Kees Cook <keescook@chromium.org>:

> On Fri, May 03, 2024 at 03:44:09PM +0200, Thomas Wei=C3=9Fschuh wrote:
>> Sysctl handlers are not supposed to modify the ctl_table passed to them.
>> Adapt the logic to work with a temporary
>> variable, similar to how it is done in other parts of the kernel.
>>
>> This is also a prerequisite to enforce the immutability of the argument
>> through the callbacks prototy.
>>
>> Fixes: 964c9dff0091 ("stackleak: Allow runtime disabling of kernel stack=
 erasing")
>> Cc: stable@vger.kernel.org
>
> I realize I've already Acked, but does this actually need to be CCed
> to stable?

You acked it without the Cc stable.
I shouldn't have kept your Ack, sorry.

Feel free to drop the Cc, it shouldn't be critical.
I suspect the bots will pick it up anyways.

>> Acked-by: Kees Cook <keescook@chromium.org>
>> Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
>> Signed-off-by: Thomas Wei=C3=9Fschuh <linux@weissschuh.net>
>> ---
>> This was split out of my sysctl-const-handler series [0].
>>
>> As that series will take some more time, submit the patch on its own,
>> as it is a generic bugfix that is valuable on its own.
>> And I can get it out of my books.
>>
>> Changelog in contrast to the patch in the series:
>> * Reword commit message to remove strong relation to the constification
>> * Cc stable
>>
>> [0] https://lore.kernel.org/lkml/20240423-sysctl-const-handler-v3-0-e0be=
ccb836e2@weissschuh.net/
>>
>> Cc: Joel Granados <j.granados@samsung.com>
>> ---
>> kernel/stackleak.c | 7 ++++---
>> 1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/kernel/stackleak.c b/kernel/stackleak.c
>> index 34c9d81eea94..b292e5ca0b7d 100644
>> --- a/kernel/stackleak.c
>> +++ b/kernel/stackleak.c
>> @@ -27,10 +27,11 @@ static int stack_erasing_sysctl(struct ctl_table *ta=
ble, int write,
>> =C2=A0=C2=A0=C2=A0 int ret =3D 0;
>> =C2=A0=C2=A0=C2=A0 int state =3D !static_branch_unlikely(&stack_erasing_=
bypass);
>> =C2=A0=C2=A0=C2=A0 int prev_state =3D state;
>> +=C2=A0=C2=A0 struct ctl_table tmp =3D *table;
>>
>> -=C2=A0=C2=A0 table->data =3D &state;
>> -=C2=A0=C2=A0 table->maxlen =3D sizeof(int);
>> -=C2=A0=C2=A0 ret =3D proc_dointvec_minmax(table, write, buffer, lenp, p=
pos);
>> +=C2=A0=C2=A0 tmp.data =3D &state;
>> +=C2=A0=C2=A0 tmp.maxlen =3D sizeof(int);
>> +=C2=A0=C2=A0 ret =3D proc_dointvec_minmax(&tmp, write, buffer, lenp, pp=
os);
>> =C2=A0=C2=A0=C2=A0 state =3D !!state;
>> =C2=A0=C2=A0=C2=A0 if (ret || !write || state =3D=3D prev_state)
>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 return ret;
>
> I can pick this up; thanks!

Thanks!