| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20191219111825.2tzgdlbk3t2pspnw@wittgenstein>
Date: Thu, 19 Dec 2019 12:18:26 +0100
From: Christian Brauner <christian.brauner@...ntu.com>
To: Aleksa Sarai <cyphar@...har.com>
Cc: Alexander Viro <viro@...iv.linux.org.uk>,
Jeff Layton <jlayton@...nel.org>,
"J. Bruce Fields" <bfields@...ldses.org>,
Shuah Khan <shuah@...nel.org>,
David Laight <david.laight@...lab.com>,
Florian Weimer <fweimer@...hat.com>, dev@...ncontainers.org,
containers@...ts.linux-foundation.org, libc-alpha@...rceware.org,
linux-api@...r.kernel.org, linux-fsdevel@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org,
arnd@...db.de
Subject: Re: [PATCH 2/2] openat2: drop open_how->__padding field
On Thu, Dec 19, 2019 at 09:55:30PM +1100, Aleksa Sarai wrote:
> The purpose of explicit padding was to allow us to use the space in the
> future (C provides no guarantee about the value of padding bytes and
> thus userspace could've provided garbage).
>
> However, the downside of explicit padding is that any extension we wish
> to add should fit the space exactly (otherwise we may end up with a u16
> which will never be used). In addition, the correct error to return for
> non-zero padding is not clear (-EINVAL doesn't imply "you're using an
> extension field unsupported by this kernel", but -E2BIG seems a bit odd
> if the structure size isn't different).
>
> The simplest solution is to just match the design of clone3(2) -- use
> u64s for all fields. The extra few-bytes cost of extra fields is not
> significant (it's unlikely configuration structs will ever be extremely
> large) and it allows for more flag space if necessary.
>
> As openat2(2) is not yet in Linus's tree, we can iron out these minor
> warts before we commit to this as a stable ABI.
>
> Suggested-by: David Laight <david.laight@...lab.com>
> Signed-off-by: Aleksa Sarai <cyphar@...har.com>
Fine with me.
Acked-by: Christian Brauner <christian.brauner@...ntu.com>
> ---
> fs/open.c | 2 --
> include/uapi/linux/openat2.h | 3 +--
> tools/testing/selftests/openat2/helpers.h | 3 +--
> .../testing/selftests/openat2/openat2_test.c | 24 +++++++------------
> 4 files changed, 10 insertions(+), 22 deletions(-)
>
> diff --git a/fs/open.c b/fs/open.c
> index 50a46501bcc9..8cdb2b675867 100644
> --- a/fs/open.c
> +++ b/fs/open.c
> @@ -993,8 +993,6 @@ static inline int build_open_flags(const struct open_how *how,
> return -EINVAL;
> if (how->resolve & ~VALID_RESOLVE_FLAGS)
> return -EINVAL;
> - if (memchr_inv(how->__padding, 0, sizeof(how->__padding)))
> - return -EINVAL;
>
> /* Deal with the mode. */
> if (WILL_CREATE(flags)) {
> diff --git a/include/uapi/linux/openat2.h b/include/uapi/linux/openat2.h
> index 19ef775e8e5e..76fad4ada2d4 100644
> --- a/include/uapi/linux/openat2.h
> +++ b/include/uapi/linux/openat2.h
> @@ -16,8 +16,7 @@
> */
> struct open_how {
> __aligned_u64 flags;
> - __u16 mode;
> - __u16 __padding[3]; /* must be zeroed */
> + __aligned_u64 mode;
> __aligned_u64 resolve;
> };
>
> diff --git a/tools/testing/selftests/openat2/helpers.h b/tools/testing/selftests/openat2/helpers.h
> index 43ca5ceab6e3..d756775d0725 100644
> --- a/tools/testing/selftests/openat2/helpers.h
> +++ b/tools/testing/selftests/openat2/helpers.h
> @@ -37,8 +37,7 @@
> */
> struct open_how {
> __aligned_u64 flags;
> - __u16 mode;
> - __u16 __padding[3]; /* must be zeroed */
> + __aligned_u64 mode;
> __aligned_u64 resolve;
> };
>
> diff --git a/tools/testing/selftests/openat2/openat2_test.c b/tools/testing/selftests/openat2/openat2_test.c
> index 0b64fedc008b..b386367c606b 100644
> --- a/tools/testing/selftests/openat2/openat2_test.c
> +++ b/tools/testing/selftests/openat2/openat2_test.c
> @@ -40,7 +40,7 @@ struct struct_test {
> int err;
> };
>
> -#define NUM_OPENAT2_STRUCT_TESTS 10
> +#define NUM_OPENAT2_STRUCT_TESTS 7
> #define NUM_OPENAT2_STRUCT_VARIATIONS 13
>
> void test_openat2_struct(void)
> @@ -57,20 +57,6 @@ void test_openat2_struct(void)
> .arg.inner.flags = O_RDONLY,
> .size = sizeof(struct open_how_ext) },
>
> - /* Normal struct with broken padding. */
> - { .name = "normal struct (non-zero padding[0])",
> - .arg.inner.flags = O_RDONLY,
> - .arg.inner.__padding = {0xa0, 0x00, 0x00},
> - .size = sizeof(struct open_how_ext), .err = -EINVAL },
> - { .name = "normal struct (non-zero padding[1])",
> - .arg.inner.flags = O_RDONLY,
> - .arg.inner.__padding = {0x00, 0x1a, 0x00},
> - .size = sizeof(struct open_how_ext), .err = -EINVAL },
> - { .name = "normal struct (non-zero padding[2])",
> - .arg.inner.flags = O_RDONLY,
> - .arg.inner.__padding = {0x00, 0x00, 0xef},
> - .size = sizeof(struct open_how_ext), .err = -EINVAL },
> -
> /* TODO: Once expanded, check zero-padding. */
>
> /* Smaller than version-0 struct. */
> @@ -169,7 +155,7 @@ struct flag_test {
> int err;
> };
>
> -#define NUM_OPENAT2_FLAG_TESTS 21
> +#define NUM_OPENAT2_FLAG_TESTS 23
>
> void test_openat2_flags(void)
> {
> @@ -214,9 +200,15 @@ void test_openat2_flags(void)
> { .name = "invalid how.mode and O_CREAT",
> .how.flags = O_CREAT,
> .how.mode = 0xFFFF, .err = -EINVAL },
> + { .name = "invalid (very large) how.mode and O_CREAT",
> + .how.flags = O_CREAT,
> + .how.mode = 0xC000000000000000ULL, .err = -EINVAL },
> { .name = "invalid how.mode and O_TMPFILE",
> .how.flags = O_TMPFILE | O_RDWR,
> .how.mode = 0x1337, .err = -EINVAL },
> + { .name = "invalid (very large) how.mode and O_TMPFILE",
> + .how.flags = O_TMPFILE | O_RDWR,
> + .how.mode = 0x0000A00000000000ULL, .err = -EINVAL },
>
> /* ->resolve must only contain RESOLVE_* flags. */
> { .name = "invalid how.resolve and O_RDONLY",
> --
> 2.24.0
>
Powered by blists - more mailing lists