linux-kernel - Re: [PATCH] scsi: sg: fix v3 compat read/write interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 4 Dec 2019 21:35:23 +0100
From:   Arnd Bergmann <arnd@...db.de>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     James Bottomley <James.Bottomley@...senpartnership.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-scsi <linux-scsi@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Doug Gilbert <dgilbert@...erlog.com>
Subject: Re: [PATCH] scsi: sg: fix v3 compat read/write interface

On Wed, Dec 4, 2019 at 7:33 PM Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
>
> On Wed, Dec 4, 2019 at 6:08 AM Arnd Bergmann <arnd@...db.de> wrote:
> >
> > To address both of these, move the definition of compat_sg_io_hdr
> > into a scsi/sg.h to make it visible to sg.c and rewrite the logic
> > for reading req_pack_id as well as the size check to a simpler
> > version that gets the expected results.
>
> I think the patch is a good thing, except for this part:
>
> > @@ -575,6 +561,14 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
> >         int err = 0, err2;
> >         int len;
> >
> > +#ifdef CONFIG_COMPAT
> > +       if (in_compat_syscall()) {
> > +               if (count < sizeof(struct compat_sg_io_hdr)) {
> > +                       err = -EINVAL;
> > +                       goto err_out;
> > +               }
> > +       } else
> > +#endif
> >         if (count < SZ_SG_IO_HDR) {
> >                 err = -EINVAL;
> >                 goto err_out;
>
> Yes, yes, I know we do things like that in some other places too, but
> I really detest this kind of ifdeffery.
>
> That
>
>          } else
>   #endif
>          if (count < SZ_SG_IO_HDR) {
>
> is just evil. Please don't add things like this where the #ifdef
> section has subtle semantic continuations outside of it. If somebody
> adds a statement in between there, it now acts completely wrong.
>
> I think you can remove the #ifdef entirely. If CONFIG_COMPAT isn't
> set, I think in_compat_syscall() just turns to 0, and the code gets
> optimized away.
>
> Hmm?

It almost works, but the part of the y2038 work that made all the
compat infrastructure visible on all architectures with or without
CONFIG_COMPAT never made it in after we decided to separate
the _time32 namespace from the compat_ namespace entirely.

It actually works on architectures that don't override asm/compat.h,
and on those that have CONFIG_COMPAT enabled, but for example
on arm64 with CONFIG_COMPAT=n I run into a build error because
asm-generic/compat.h is not included here, and getting that to
work reliably needed some rearranging of other files.

I could

a) dig out my old patches that did this right, so we can kill off
most of these #ifdefs in compat code throughout the kernel
(probably not this merge window),

b) change compat_sg_io_hdr to use plain types (u32, s32, ...), or

c) conditionally define another macro for SZ_COMPAT_SG_IO_HDR
like (pasted into gmail, won't apply)

diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index af152a7e71c7..039858014e18 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -198,6 +198,11 @@ static void sg_device_destroy(struct kref *kref);

 #define SZ_SG_HEADER sizeof(struct sg_header)
 #define SZ_SG_IO_HDR sizeof(sg_io_hdr_t)
+#ifdef CONFIG_COMPAT
+#define SZ_COMPAT_SG_IO_HDR SZ_SG_IO_HDR
+#else
+#define SZ_COMPAT_SG_IO_HDR sizeof(struct compat_sg_io_hdr)
+#endif
 #define SZ_SG_IOVEC sizeof(sg_iovec_t)
 #define SZ_SG_REQ_INFO sizeof(sg_req_info_t)

@@ -561,15 +566,12 @@ sg_new_read(Sg_fd * sfp, char __user *buf,
size_t count, Sg_request * srp)
        int err = 0, err2;
        int len;

-#ifdef CONFIG_COMPAT
        if (in_compat_syscall()) {
-               if (count < sizeof(struct compat_sg_io_hdr)) {
+               if (count < SZ_COMPAT_SG_IO_HDR) {
                        err = -EINVAL;
                        goto err_out;
                }
-       } else
-#endif
-       if (count < SZ_SG_IO_HDR) {
+       } else if (count < SZ_SG_IO_HDR) {
                err = -EINVAL;
                goto err_out;
        }

        Arnd