Messages in this thread | | | Date | Sat, 17 Apr 2021 18:09:44 +0000 | From | Al Viro <> | Subject | Re: [PATCH] x86/uaccess: small optimization in unsafe_copy_to_user() |
| |
On Sat, Apr 17, 2021 at 09:27:04AM -0700, Linus Torvalds wrote: > On Sat, Apr 17, 2021 at 9:08 AM Linus Torvalds > <torvalds@linux-foundation.org> wrote: > > > > Side note: I'm, looking at the readdir cases that I wrote, and I have > > to just say that is broken too. So "stones and glass houses" etc, and > > I'll have to fix that too. > > In particular, the very very old OLD_READDIR interface that only fills > in one dirent at a time didn't call verify_dirent_name(). Same for the > compat version. > > This requires a corrupt filesystem to be an issue (and even then, > most/all would have the length of a directory entry in an 'unsigned > char', so even corrupt filesystems would generally never have a > negative name length). > > So I don't think it's an issue in _practice_, but at the same time it > is very much an example of the same issue that put_cmsg() has in > net-next: unsafe user copies should be fully guarded and not have some > "but this would never happen because callers would never do anything > bad". > > Al - fairly trivial patch applied, comments?
Should be fine... FWIW, I've a patch in the same area, making those suckers return bool. Seeing that they are only ever called via dir_emit(), dir_emit_dot() and dir_emit_dotdot() and all of those return ->actor(...) == 0...
Anyway, that'd be trivial to rebase on top of yours.
| |