lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20231202222706.GT38156@ZenIV> Date: Sat, 2 Dec 2023 22:27:06 +0000 From: Al Viro <viro@...iv.linux.org.uk> To: Kees Cook <keescook@...omium.org> Cc: "Guilherme G. Piccoli" <gpiccoli@...lia.com>, Tony Luck <tony.luck@...el.com>, linux-hardening@...r.kernel.org, Christian Brauner <brauner@...nel.org>, "Peter Zijlstra (Intel)" <peterz@...radead.org>, linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org Subject: Re: [PATCH 5/5] pstore: inode: Use cleanup.h for struct pstore_private On Sat, Dec 02, 2023 at 01:22:15PM -0800, Kees Cook wrote: > static void *pstore_ftrace_seq_start(struct seq_file *s, loff_t *pos) > { > @@ -338,9 +339,8 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record) > { > struct dentry *dentry; > struct inode *inode __free(iput) = NULL; > - int rc = 0; > char name[PSTORE_NAMELEN]; > - struct pstore_private *private, *pos; > + struct pstore_private *private __free(pstore_private) = NULL, *pos; > size_t size = record->size + record->ecc_notice_size; > > if (WARN_ON(!inode_is_locked(d_inode(root)))) > @@ -356,7 +356,6 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record) > return -EEXIST; > } > > - rc = -ENOMEM; > inode = pstore_get_inode(root->d_sb); > if (!inode) > return -ENOMEM; > @@ -373,7 +372,7 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record) > > dentry = d_alloc_name(root, name); > if (!dentry) > - goto fail_private; > + return -ENOMEM; > > private->dentry = dentry; > private->record = record; > @@ -386,13 +385,9 @@ int pstore_mkfile(struct dentry *root, struct pstore_record *record) > > d_add(dentry, no_free_ptr(inode)); > > - list_add(&private->list, &records_list); > + list_add(&(no_free_ptr(private))->list, &records_list); That's really brittle. It critically depends upon having no failure exits past the assignment to ->i_private; once you've done that, you have transferred the ownership of that thing to the inode (look at your ->evict_inode()). But you can't say inode->i_private = no_free_ptr(private); since you are using private past that point.
Powered by blists - more mailing lists