linux-kernel - Re: [PATCH] seq_file: don't set read position for invalid iterator

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 23 Sep 2016 08:54:12 -0700
From:   Dan Williams <dan.j.williams@...el.com>
To:     Tomasz Majchrzak <tomasz.majchrzak@...el.com>
Cc:     linux-fsdevel <linux-fsdevel@...r.kernel.org>,
        aleksey.obitotskiy@...el.com,
        "Baldysiak, Pawel" <pawel.baldysiak@...el.com>,
        Artur Paszkiewicz <artur.paszkiewicz@...el.com>,
        maksymilian.kunt@...el.com, Al Viro <viro@...iv.linux.org.uk>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] seq_file: don't set read position for invalid iterator

[ adding Al ]

On Tue, Aug 23, 2016 at 2:19 AM, Tomasz Majchrzak
<tomasz.majchrzak@...el.com> wrote:
> If kernfs file is empty on a first read, successive read operations
> using the same file descriptor will return no data, even when data is
> available. Default kernfs 'seq_next' implementation advances iterator
> position even when next object is not there. Kernfs 'seq_start' for
> following requests will not return iterator as position is already on
> the second object.
>
> Don't set read position if valid iterator has not been returned.

Can you say a bit about how you found this?  So we have an idea about
userspace tooling is broken by this bug.

>
> Signed-off-by: Tomasz Majchrzak <tomasz.majchrzak@...el.com>

I would add "Cc: <stable@...r.kernel.org>" to the next version of this patch.

>  fs/seq_file.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/seq_file.c b/fs/seq_file.c
> index 19f532e..893db43 100644
> --- a/fs/seq_file.c
> +++ b/fs/seq_file.c
> @@ -242,7 +242,8 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
>                         m->count = 0;
>                 if (unlikely(!m->count)) {
>                         p = m->op->next(m, p, &pos);
> -                       m->index = pos;
> +                       if (p && !IS_ERR(p))

Lets change this to use the IS_ERR_OR_NULL() helper, and do the same
with the earlier if (!p || IS_ERR()) a few lines up in the loop.

Other than that, this looks good to me.

Reviewed-by: Dan Williams <dan.j.williams@...el.com>