From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm2-f12.google.com (mail-wm2-f12.google.com [74.125.225.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC3624AEBFE for ; Wed, 16 Sep 2026 09:50:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.140 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789552238; cv=none; b=noQkUModu9L9GBWqRQABVSbJa7lqdm0l/KvOkCTsgbxj8uXeT97LANo3X3AFDCG0Fe9YvXdvtZpC8d/MQfBpSTwZA5OWnzbharkgknYwPOwsn6tDDdn4dFBhj4XxLZYSRKsnT7VluYVYxcSXZJzhg5xTV6HzyhFkYNSw8XTc3SI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789552238; c=relaxed/simple; bh=zVftL0e6KTn1Fup/RmgkkUqXURXldH56P13A6WLi8KQ=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=AqsJTl1xxQs2WsUFbBXdPD9+T0CvxzJgnj/eLVQoXXPhsU5zSiAiTlgKp5ZFjMjqDBoDMDLsfHttQQjFHdTgMAdH6g1bLmHItSx8bsw2lMvTweZRJd92uWRQD3r/fAhxjanZ1c7bp/nuXqncXUVwsjFbpxKOt5uIugq6rg93lTs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Dzby88uf; arc=none smtp.client-ip=74.125.225.140 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Dzby88uf" Received: by mail-wm2-f12.google.com with SMTP id 5b1f17b1804b1-49e66390995so4145635e9.2 for ; Wed, 16 Sep 2026 02:50:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789552219; x=1790157019; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=79YAdtaHEv3S3nDvYc6X9C5ar06F3FncZEtUncQdJQ4=; b=Dzby88ufsV19pEuHSQnO0Z3r75FgiJ44qF/jXgKTm3w+wAYVSGDUH6LyexeTQiqa/g mb7EWvB3UuhKI7YAj+i2TOZr9/Z0Jn4HnQ3SO6kUkIrvAwSnRTzKzvfGb0So06LetuEf Ts3VEs9CM5zHiWBu1V4JZ71jpXN6ZkETnLDwqKE7PV3aA5kY0+ABvWOim6YHWnbq5cCK nHzOneSJDYvvXY/C7BkTDDo/hN/r3+9IBjrwRhsKYcoz9kdWM+uOTg6K8qjcDaH6D7EX KA0rYEGGzwyipB5cM3imDGmhTpbUuWgcSiyW3ZIBr1TR7/Q7dN5mD7jr++kuJyreI5UR skeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789552219; x=1790157019; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=79YAdtaHEv3S3nDvYc6X9C5ar06F3FncZEtUncQdJQ4=; b=x2cKpWz7g4DrfKhTK0SE/6BOWV00VBXqHYsdvcHXt74xRa2UqfzYgshXOS0W6HavaM YdA5rDPN3+IRLmm+9xjkCz98ON1HEXN1dc50hMuOl6cCLKodPVjOwaeqN759XE0BHtmt gO638sjboJQeug71lGZ1KZQ4611r0AIkQjvyrSiaXApxZW52T4ouuFrFZEBDHXonA7zp DGgirk3RuQXZfQAtJF96JKksgPtNdk88v6AURzkMYI3nAdVlP2Pf/dENs2lK8uWvp2oc oUW38lrHQXf4lDVLF4Eh3TLdITRtF7rvK8Y6UDxRsxxfhNAji+6zbeTDstjGDyxxRHX0 D2AA== X-Forwarded-Encrypted: i=1; AKwUvBwL2AVaPMssFX8cfZUnm59lZaXiLkcvUWHB4HwEWb2QQNw+uG0XnJh1o6zHOKZ2evqRxgi04metpw==@vger.kernel.org X-Gm-Message-State: AFuF++lHr9HyCb5dHr7xWDIChBsa3vPCftsw4ZYQny69AhSliVIPXv9Y t6xNlSGjOpfE+zSQ6LuZnPlhU58bj+1jL8DCQzYd8gphyjQI+yPXvn5V X-Gm-Gg: AYBFou2ttWVAOV5IaLGaqpQhZ6k2jDEw/5wWgMAxHp7+K2QINcmCF3ESTKYCxP7ayBl s81MdhJ/NJ2Fi9041rfVGyBMPAEtO96h0m3cThzasa/5oJxRDffWDAJKN1GbloCX2oitlfEnNFD AvFYPjSs7ERWet220p50dp3ZIfsbI9kcSdnFi7/Eg523eY/0F/u8g0PX5bhbGqHAuH2pEP9eMLI AdOztKZ0RZy9TPUs4Dq+py9Efr0STue+QkxaIDo11Xeb9/YXV2Qy/ChKGeXIDXWLYLUo1h320Gm ptdzB9JqENJW2Zw4NoAZtzUXX3JclMUZUkGh+JrUx95JYJgLXe2zblvaiTXO1LBPTbSkKkSFCaL 1LlkOqBMEyYvWRNZmdYXtXU5ozlpF9PnS0TTeB8uFU9xM4UAt8Gm30PeUCkr48Y6dpxu1dslh2C PCJWm8PVLZQp+Cc/6ok9Xgsu6oX+z+5oPlbewcOp/q62HEnpktknt/S7pyY0waQSryL+nVQyf7U OArwMRbFtx5YiL08NtcBu5W0grZRiCM9nRS1wxHfXe7Rug= X-Received: by 2002:a05:600c:4ec6:b0:49c:fea3:8633 with SMTP id 5b1f17b1804b1-49eb732aec0mr19444455e9.24.1789552219000; Wed, 16 Sep 2026 02:50:19 -0700 (PDT) Received: from pumpkin (82-69-66-36.dsl.in-addr.zen.co.uk. [82.69.66.36]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49e83b02245sm84055225e9.10.2026.09.16.02.50.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 16 Sep 2026 02:50:18 -0700 (PDT) Date: Wed, 16 Sep 2026 10:50:17 +0100 From: David Laight To: Linus Torvalds Cc: Jann Horn , Christian Brauner , Alexander Viro , Jan Kara , Ingo Molnar , Peter Zijlstra , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Oleg Nesterov , linux-alpha@vger.kernel.org, linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org, linux-csky@vger.kernel.org, linux-hexagon@vger.kernel.org, linux-m68k@lists.linux-m68k.org, linux-mips@vger.kernel.org, linux-openrisc@vger.kernel.org, linux-parisc@vger.kernel.org, linux-sh@vger.kernel.org, sparclinux@vger.kernel.org, linux-um@lists.infradead.org, Jens Axboe , io-uring@vger.kernel.org, netdev@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-gpio@vger.kernel.org, linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org, bpf@vger.kernel.org, David Airlie , virtualization@lists.linux.dev, kvm@vger.kernel.org, kexec@lists.infradead.org, linux-hyperv@vger.kernel.org Subject: Re: [PATCH RFC POC 00/50] file: handle files on syscall exit Message-ID: <20260916105017.13ea5e36@pumpkin> In-Reply-To: References: <20260915-work-fd-reserve-unify-folded-v1-0-4d5217d6b246@kernel.org> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf) Precedence: bulk X-Mailing-List: linux-sh@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Tue, 15 Sep 2026 12:08:57 -0700 Linus Torvalds wrote: > On Tue, 15 Sept 2026 at 10:52, Jann Horn wrote: > > > > Is this mainly about stuff like "we installed a file descriptor and > > then the following put_user() failed"? Because if so, I think a nicer > > fix would be to have a policy of "if userspace provides unwritable > > memory to a syscall, just keep going and pretend the access worked", > > and maybe have a sysctl that kills the process when this happens to > > emphasize that userspace should not be doing this. > > We've done that before, where we just ignore put_user() errors and the > user gets whatever the user gets. > > It is maybe not optimal, but it's fine. You can find quite a lot of > unchecked put_user() calls with a pattern like > > git grep '^[[:space:]]*put_user(.*);' > > and some of them are in core code - see the two in kernel/fork.c, for example. > > One of them says "if userspace has not set up a proper pointer then > tough luck". The other one doesn't even bother with a comment. I think the code should try to return EFAULT (IIRC that is too hard in one of the exec cases). Otherwise very unexpected things might happen if the memory is just readonly. If you ignore the error and the pointer is invalid the application will get a SIGSEGV and (usually) die. But winding back kernel data because a user copy failed is likely to be problematic/difficult and at best have error path code that isn't really tested. As well as writing fd numbers to userspace, some sockopt code tries to wind back if the write to optlen fails (which has been read earlier). I've forgotten which Unix converted EFAULT to SIGSEGV in the system call exit code - I'm sure one of the ones I've used did. David > > The scheduler has two cases too, although one of them is admittedly > for another error case. > > So yes, saying "if you pass bogus arguments, you get what you get" is > a valid model. It's perhaps not the *preferred* model, but it's not > wrong. > > It *would* be wrong to take code that already has error handling and > remove the error handling, though. > > Linus >