linux-kernel - Re: [PATCH v2] sysctl: handle table->maxlen properly for proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YovECEBVeCZl79fi@bombadil.infradead.org>
Date:   Mon, 23 May 2022 10:27:36 -0700
From:   Luis Chamberlain <mcgrof@...nel.org>
To:     Muchun Song <songmuchun@...edance.com>
Cc:     linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        willy@...radead.org, Kees Cook <keescook@...omium.org>,
        Iurii Zaikin <yzaikin@...gle.com>
Subject: Re: [PATCH v2] sysctl: handle table->maxlen properly for proc_dobool

On Sun, May 22, 2022 at 01:26:24PM +0800, Muchun Song wrote:
> Setting ->proc_handler to proc_dobool at the same time setting ->maxlen
> to sizeof(int) is counter-intuitive, it is easy to make mistakes.  For
> robustness, fix it by reimplementing proc_dobool() properly.
> 
> Signed-off-by: Muchun Song <songmuchun@...edance.com>
> Cc: Luis Chamberlain <mcgrof@...nel.org>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Iurii Zaikin <yzaikin@...gle.com>
> ---

Thanks for your patch Muchun!

Does this fix an actualy issue? Because the comit log suggest so.
If so is there a bug which is known or a reproducer which can be
implemented to showcase that bug?

The reason I ask is that we have automatic scrapers for bug fixes,
and I tend to prefer to avoid giving those automatic scrapers
the idea that a patch is a fix for a kernel bug when it it is not.
If what you are change is an optimization then your commit log should
clarify that.

If you are fixing something then you must be clear about about the
details I mentioned. And then, if it does fix an issue, how long
has the issue been know, what are the consequences of it? And up
to what kernel is this issue present for?

  Luis