From: Kees Cook <keescook@chromium.org>
To: Jann Horn <jannh@google.com>
Cc: kernel list <linux-kernel@vger.kernel.org>,
stable <stable@vger.kernel.org>,
Sargun Dhillon <sargun@sargun.me>,
Christian Brauner <christian@brauner.io>,
Tycho Andersen <tycho@tycho.ws>,
David Laight <David.Laight@aculab.com>,
Christoph Hellwig <hch@lst.de>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Aleksa Sarai <cyphar@cyphar.com>,
Matt Denton <mpdenton@google.com>,
Chris Palmer <palmer@google.com>,
Robert Sesek <rsesek@google.com>,
Giuseppe Scrivano <gscrivan@redhat.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Andy Lutomirski <luto@amacapital.net>,
Will Drewry <wad@chromium.org>, Shuah Khan <shuah@kernel.org>,
Network Development <netdev@vger.kernel.org>,
Linux Containers <containers@lists.linux-foundation.org>,
Linux API <linux-api@vger.kernel.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@vger.kernel.org>
Subject: Re: [PATCH v7 2/9] pidfd: Add missing sock updates for pidfd_getfd()
Date: Thu, 9 Jul 2020 14:17:08 -0700 [thread overview]
Message-ID: <202007091416.42530A9C@keescook> (raw)
In-Reply-To: <CAG48ez1gz3mtAO5QdvGEMt5KnRBq7hhWJMGS6piGDrcGNEdSrQ@mail.gmail.com>
On Thu, Jul 09, 2020 at 10:00:42PM +0200, Jann Horn wrote:
> On Thu, Jul 9, 2020 at 8:26 PM Kees Cook <keescook@chromium.org> wrote:
> > The sock counting (sock_update_netprioidx() and sock_update_classid())
> > was missing from pidfd's implementation of received fd installation. Add
> > a call to the new __receive_sock() helper.
> [...]
> > diff --git a/kernel/pid.c b/kernel/pid.c
> [...]
> > @@ -642,10 +643,12 @@ static int pidfd_getfd(struct pid *pid, int fd)
> > }
> >
> > ret = get_unused_fd_flags(O_CLOEXEC);
> > - if (ret < 0)
> > + if (ret < 0) {
> > fput(file);
> > - else
> > + } else {
> > fd_install(ret, file);
> > + __receive_sock(file);
> > + }
>
> __receive_sock() has to be before fd_install(), otherwise `file` can
> be a dangling pointer.
Burned by fd_install()'s API again. Thanks. I will respin.
--
Kees Cook
next prev parent reply other threads:[~2020-07-09 21:17 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-09 18:26 [PATCH v7 0/9] Add seccomp notifier ioctl that enables adding fds Kees Cook
2020-07-09 18:26 ` [PATCH v7 1/9] net/compat: Add missing sock updates for SCM_RIGHTS Kees Cook
2020-07-10 11:28 ` Christian Brauner
2020-07-09 18:26 ` [PATCH v7 2/9] pidfd: Add missing sock updates for pidfd_getfd() Kees Cook
2020-07-09 20:00 ` Jann Horn
2020-07-09 21:17 ` Kees Cook [this message]
2020-07-09 22:35 ` Kees Cook
2020-07-09 18:26 ` [PATCH v7 3/9] net/scm: Regularize compat handling of scm_detach_fds() Kees Cook
2020-08-07 20:29 ` John Stultz
2020-08-07 22:18 ` Kees Cook
2020-08-08 0:02 ` John Stultz
2020-08-08 7:17 ` Kees Cook
2020-07-09 18:26 ` [PATCH v7 4/9] fs: Move __scm_install_fd() to __receive_fd() Kees Cook
2020-07-09 18:26 ` [PATCH v7 5/9] fs: Add receive_fd() wrapper for __receive_fd() Kees Cook
2020-07-09 18:26 ` [PATCH v7 6/9] pidfd: Replace open-coded receive_fd() Kees Cook
2020-07-09 18:26 ` [PATCH v7 7/9] fs: Expand __receive_fd() to accept existing fd Kees Cook
2020-07-09 18:26 ` [PATCH v7 8/9] seccomp: Introduce addfd ioctl to seccomp user notifier Kees Cook
2020-07-14 18:20 ` Will Drewry
2020-07-09 18:26 ` [PATCH v7 9/9] selftests/seccomp: Test SECCOMP_IOCTL_NOTIF_ADDFD Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202007091416.42530A9C@keescook \
--to=keescook@chromium.org \
--cc=David.Laight@aculab.com \
--cc=christian@brauner.io \
--cc=containers@lists.linux-foundation.org \
--cc=cyphar@cyphar.com \
--cc=davem@davemloft.net \
--cc=gregkh@linuxfoundation.org \
--cc=gscrivan@redhat.com \
--cc=hch@lst.de \
--cc=jannh@google.com \
--cc=kuba@kernel.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mpdenton@google.com \
--cc=netdev@vger.kernel.org \
--cc=palmer@google.com \
--cc=rsesek@google.com \
--cc=sargun@sargun.me \
--cc=shuah@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tycho@tycho.ws \
--cc=viro@zeniv.linux.org.uk \
--cc=wad@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.