linux-kernel - Re: linux-next: manual merge of the selinux tree with the block tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 7 Oct 2021 16:20:17 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     Stephen Rothwell <sfr@...b.auug.org.au>
Cc:     Jens Axboe <axboe@...nel.dk>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Next Mailing List <linux-next@...r.kernel.org>,
        Pavel Begunkov <asml.silence@...il.com>
Subject: Re: linux-next: manual merge of the selinux tree with the block tree

On Wed, Oct 6, 2021 at 8:57 PM Stephen Rothwell <sfr@...b.auug.org.au> wrote:
>
> Hi all,
>
> Today's linux-next merge of the selinux tree got a conflict in:
>
>   fs/io_uring.c
>
> between commit:
>
>   3d2b8972f292 ("io_uring: optimise plugging")
>
> from the block tree and commit:
>
>   5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring")
>
> from the selinux tree.

It looks like some of the conflict is also due to cdc1404a4046
("lsm,io_uring: add LSM hooks to io_uring") but based on a quick look
the fixup seems correct.

Thanks Stephen.

> diff --cc fs/io_uring.c
> index 73135c5c6168,f89d00af3a67..000000000000
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@@ -903,8 -917,10 +905,10 @@@ struct io_op_def
>         unsigned                buffer_select : 1;
>         /* do prep async if is going to be punted */
>         unsigned                needs_async_setup : 1;
>  -      /* should block plug */
>  -      unsigned                plug : 1;
>  +      /* opcode is not supported by this kernel */
>  +      unsigned                not_supported : 1;
> +       /* skip auditing */
> +       unsigned                audit_skip : 1;
>         /* size of async data needed, if any */
>         unsigned short          async_size;
>   };
> @@@ -6542,9 -6622,12 +6576,12 @@@ static int io_issue_sqe(struct io_kioc
>         const struct cred *creds = NULL;
>         int ret;
>
>  -      if ((req->flags & REQ_F_CREDS) && req->creds != current_cred())
>  +      if (unlikely((req->flags & REQ_F_CREDS) && req->creds != current_cred()))
>                 creds = override_creds(req->creds);
>
> +       if (!io_op_defs[req->opcode].audit_skip)
> +               audit_uring_entry(req->opcode);
> +
>         switch (req->opcode) {
>         case IORING_OP_NOP:
>                 ret = io_nop(req, issue_flags);
> @@@ -7042,10 -7071,34 +7082,15 @@@ static int io_init_req(struct io_ring_c
>                 if (!req->creds)
>                         return -EINVAL;
>                 get_cred(req->creds);
> +               ret = security_uring_override_creds(req->creds);
> +               if (ret) {
> +                       put_cred(req->creds);
> +                       return ret;
> +               }
>                 req->flags |= REQ_F_CREDS;
>         }
>  -      state = &ctx->submit_state;
>  -
>  -      /*
>  -       * Plug now if we have more than 1 IO left after this, and the target
>  -       * is potentially a read/write to block based storage.
>  -       */
>  -      if (!state->plug_started && state->ios_left > 1 &&
>  -          io_op_defs[req->opcode].plug) {
>  -              blk_start_plug(&state->plug);
>  -              state->plug_started = true;
>  -      }
>  -
>  -      if (io_op_defs[req->opcode].needs_file) {
>  -              req->file = io_file_get(ctx, req, READ_ONCE(sqe->fd),
>  -                                      (sqe_flags & IOSQE_FIXED_FILE));
>  -              if (unlikely(!req->file))
>  -                      ret = -EBADF;
>  -      }
>
>  -      state->ios_left--;
>  -      return ret;
>  +      return io_req_prep(req, sqe);
>   }
>
>   static int io_submit_sqe(struct io_ring_ctx *ctx, struct io_kiocb *req,

-- 
paul moore
www.paul-moore.com