linux-kernel - Re: [PATCH] vhost_net: Use fdget() and fdput()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230511053125.GI3390869@ZenIV>
Date:   Thu, 11 May 2023 06:31:25 +0100
From:   Al Viro <viro@...iv.linux.org.uk>
To:     ye.xingchen@....com.cn
Cc:     mst@...hat.com, jasowang@...hat.com, kvm@...r.kernel.org,
        virtualization@...ts.linux-foundation.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] vhost_net: Use fdget() and fdput()

On Fri, May 05, 2023 at 02:24:04PM +0800, ye.xingchen@....com.cn wrote:
> From: Ye Xingchen <ye.xingchen@....com.cn>
> 
> convert the fget()/fput() uses to fdget()/fdput().
> 
> Signed-off-by: Ye Xingchen <ye.xingchen@....com.cn>
> ---
>  drivers/vhost/net.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
> index ae2273196b0c..5b3fe4805182 100644
> --- a/drivers/vhost/net.c
> +++ b/drivers/vhost/net.c
> @@ -1466,17 +1466,17 @@ static struct ptr_ring *get_tap_ptr_ring(struct file *file)
> 
>  static struct socket *get_tap_socket(int fd)
>  {
> -	struct file *file = fget(fd);
> +	struct fd f = fdget(fd);
>  	struct socket *sock;
> 
> -	if (!file)
> +	if (!f.file)
>  		return ERR_PTR(-EBADF);
> -	sock = tun_get_socket(file);
> +	sock = tun_get_socket(f.file);
>  	if (!IS_ERR(sock))
>  		return sock;
> -	sock = tap_get_socket(file);
> +	sock = tap_get_socket(f.file);
>  	if (IS_ERR(sock))
> -		fput(file);
> +		fdput(f);
>  	return sock;

NAK.  For the same reason why the sockfd_lookup() counterpart of that
patch is broken.  After your change there's no way for the caller
to tell whether we have bumped the refcount of file in question;
this can't possibly work.