completely ignore unknown open flags

completely ignore unknown open flags

[Christoph Hellwig]

This is the fallout from the reject unknown flags discussion a few
weeks back.  So to keep backwards compatibily we can't _reject_ unknown
flags.  But we'd better totally ignore them and don't pass them to
file systems or back to userspace using fcntl.

[PATCH 1/2] fs: add a VALID_OPEN_FLAGS

[Christoph Hellwig]

Add a central define for all valid open flags, and use it in the uniqueness
check.

Signed-off-by: Christoph Hellwig <hch@lst.de>
---
 fs/fcntl.c            | 14 ++++----------
 include/linux/fcntl.h |  6 ++++++
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/fs/fcntl.c b/fs/fcntl.c
index be8fbe289087..de1b16bb6a29 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -742,16 +742,10 @@ static int __init fcntl_init(void)
 	 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
 	 * is defined as O_NONBLOCK on some platforms and not on others.
 	 */
-	BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
-		O_RDONLY	| O_WRONLY	| O_RDWR	|
-		O_CREAT		| O_EXCL	| O_NOCTTY	|
-		O_TRUNC		| O_APPEND	| /* O_NONBLOCK	| */
-		__O_SYNC	| O_DSYNC	| FASYNC	|
-		O_DIRECT	| O_LARGEFILE	| O_DIRECTORY	|
-		O_NOFOLLOW	| O_NOATIME	| O_CLOEXEC	|
-		__FMODE_EXEC	| O_PATH	| __O_TMPFILE	|
-		__FMODE_NONOTIFY
-		));
+	BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=
+		HWEIGHT32(
+			(VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
+			__FMODE_EXEC | __FMODE_NONOTIFY));
 
 	fasync_cache = kmem_cache_create("fasync_cache",
 		sizeof(struct fasync_struct), 0, SLAB_PANIC, NULL);
diff --git a/include/linux/fcntl.h b/include/linux/fcntl.h
index 76ce329e656d..1b48d9c9a561 100644
--- a/include/linux/fcntl.h
+++ b/include/linux/fcntl.h
@@ -3,6 +3,12 @@
 
 #include <uapi/linux/fcntl.h>
 
+/* list of all valid flags for the open/openat flags argument: */
+#define VALID_OPEN_FLAGS \
+	(O_RDONLY | O_WRONLY | O_RDWR | O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | \
+	 O_APPEND | O_NDELAY | O_NONBLOCK | O_NDELAY | __O_SYNC | O_DSYNC | \
+	 FASYNC	| O_DIRECT | O_LARGEFILE | O_DIRECTORY | O_NOFOLLOW | \
+	 O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE)
 
 #ifndef force_o_largefile
 #define force_o_largefile() (BITS_PER_LONG != 32)
-- 
2.11.0

[PATCH 2/2] fs: completely ignore unknown open flags

[Christoph Hellwig]

Currently we just stash anything we got into file->f_flags, and the
report it in fcntl(F_GETFD).  This patch just clears out all unknown
flags so that we don't pass them to the fs or report them.

Signed-off-by: Christoph Hellwig <hch@lst.de>
---
 fs/open.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/open.c b/fs/open.c
index 949cef29c3bb..7bba2b952f1e 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -900,6 +900,12 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
 	int lookup_flags = 0;
 	int acc_mode = ACC_MODE(flags);
 
+	/*
+	 * Clear out all open flags we don't know about so that we don't report
+	 * them in fcntl(F_GETFD) or similar interfaces.
+	 */
+	flags &= VALID_OPEN_FLAGS;
+
 	if (flags & (O_CREAT | __O_TMPFILE))
 		op->mode = (mode & S_IALLUGO) | S_IFREG;
 	else
-- 
2.11.0

Re: completely ignore unknown open flags

[Linus Torvalds]

On Thu, Apr 27, 2017 at 12:42 AM, Christoph Hellwig <hch@lst.de> wrote:
> This is the fallout from the reject unknown flags discussion a few
> weeks back.  So to keep backwards compatibily we can't _reject_ unknown
> flags.  But we'd better totally ignore them and don't pass them to
> file systems or back to userspace using fcntl.

Ack, this makes sense to me. It's crazy to let fcntl etc show bits
that the kernel isn't even using.

I'm assuming this will come through Al eventually. It doesn't seem
high-priority for me to worry about it just before the 4.11 release,
but it might be worth marking for stable just to percolate the change
eventually to other kernels, and keep these kinds of differences
minimal.

            Linus

Re: completely ignore unknown open flags

[Al Viro]

On Thu, Apr 27, 2017 at 12:41:39PM -0700, Linus Torvalds wrote:
> On Thu, Apr 27, 2017 at 12:42 AM, Christoph Hellwig <hch@lst.de> wrote:
> > This is the fallout from the reject unknown flags discussion a few
> > weeks back.  So to keep backwards compatibily we can't _reject_ unknown
> > flags.  But we'd better totally ignore them and don't pass them to
> > file systems or back to userspace using fcntl.
> 
> Ack, this makes sense to me. It's crazy to let fcntl etc show bits
> that the kernel isn't even using.
> 
> I'm assuming this will come through Al eventually. It doesn't seem
> high-priority for me to worry about it just before the 4.11 release,
> but it might be worth marking for stable just to percolate the change
> eventually to other kernels, and keep these kinds of differences
> minimal.

Applied tonight, still hadn't pushed it out into -next - the tree goes through
testing.

Re: completely ignore unknown open flags

[Christoph Hellwig]

On Thu, Apr 27, 2017 at 12:41:39PM -0700, Linus Torvalds wrote:
> I'm assuming this will come through Al eventually. It doesn't seem
> high-priority for me to worry about it just before the 4.11 release,
> but it might be worth marking for stable just to percolate the change
> eventually to other kernels, and keep these kinds of differences
> minimal.

Agreed.  I just wanted you on Cc as your were very vocal on the
issue.