[RFC PATCH v2 0/3] uid_r: convert tun, ivpu and tee

[RFC PATCH v2 0/3] uid_r: convert tun, ivpu and tee

[Jan Koester via OP-TEE]

Hi,

Building the UUID/GUID id RFC (uid_r v2,
<cover.1792552161.git.jan.koester@tuxist.de>) with a distribution
config instead of the one I had tested with turned up three users of
kuid_t/kgid_t it doesn't build with: kuid_t is a tagged union now and
has no .val, and it no longer fits READ_ONCE()/WRITE_ONCE().

1/3 tun: TUNSETOWNER/TUNSETGROUP write the owner and group under RTNL,
    tun_fill_info() may read them without it. Mark that read as
    data_race() instead of READ_ONCE(). Only classic ids from
    make_kuid()/make_kgid() are ever stored there.

2/3 accel/ivpu: the per-user context limits are keyed by
    __kuid_val(). UUID and GUID users share the (uid_t)-1 bucket, which
    only makes the limit stricter for them.

3/3 tee: the TEE_IOCTL_LOGIN_USER client UUID is derived from the
    classic uid. With __kuid_val() alone every UUID or GUID user would
    get the same one and could act as any other such user towards the
    TEE, so those logins are refused with -EPERM, like ublk refuses
    unprivileged devices to them in the series.

These belong into the series before the patch that lets kuid_t and
kgid_t hold a UUID or a GUID and will be folded in there in v3; I'm sending
them now so that the reviewers of these drivers see what uid_r means
for them.

Jan Koester (3):
  tun: read the owner and group without READ_ONCE()
  accel/ivpu: key user limits by __kuid_val()
  tee: refuse user logins of UUID and GUID users

 drivers/accel/ivpu/ivpu_drv.c |  2 +-
 drivers/net/tun.c             |  8 ++++----
 drivers/tee/tee_core.c        | 13 +++++++++++--
 3 files changed, 16 insertions(+), 7 deletions(-)

-- 
2.53.0

Re: [RFC PATCH v2 0/3] uid_r: convert tun, ivpu and tee

[Willem de Bruijn]

Jan Koester wrote:
> Hi,
> 
> Building the UUID/GUID id RFC (uid_r v2,
> <cover.1792552161.git.jan.koester@tuxist.de>) with a distribution
> config instead of the one I had tested with turned up three users of
> kuid_t/kgid_t it doesn't build with: kuid_t is a tagged union now and
> has no .val, and it no longer fits READ_ONCE()/WRITE_ONCE().
> 
> 1/3 tun: TUNSETOWNER/TUNSETGROUP write the owner and group under RTNL,
>     tun_fill_info() may read them without it. Mark that read as
>     data_race() instead of READ_ONCE(). Only classic ids from
>     make_kuid()/make_kgid() are ever stored there.
> 
> 2/3 accel/ivpu: the per-user context limits are keyed by
>     __kuid_val(). UUID and GUID users share the (uid_t)-1 bucket, which
>     only makes the limit stricter for them.
> 
> 3/3 tee: the TEE_IOCTL_LOGIN_USER client UUID is derived from the
>     classic uid. With __kuid_val() alone every UUID or GUID user would
>     get the same one and could act as any other such user towards the
>     TEE, so those logins are refused with -EPERM, like ublk refuses
>     unprivileged devices to them in the series.
> 
> These belong into the series before the patch that lets kuid_t and
> kgid_t hold a UUID or a GUID and will be folded in there in v3; I'm sending
> them now so that the reviewers of these drivers see what uid_r means
> for them.
> 
> Jan Koester (3):
>   tun: read the owner and group without READ_ONCE()
>   accel/ivpu: key user limits by __kuid_val()
>   tee: refuse user logins of UUID and GUID users
> 
>  drivers/accel/ivpu/ivpu_drv.c |  2 +-
>  drivers/net/tun.c             |  8 ++++----
>  drivers/tee/tee_core.c        | 13 +++++++++++--
>  3 files changed, 16 insertions(+), 7 deletions(-)

I only received this cover letter. Also do not see the patches on
https://lore.kernel.org/all