linux-kernel - Re: [PATCH v1 0/3] overlayfs: Optimize override/revert creds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87a5liy3le.fsf@intel.com>
Date: Wed, 24 Apr 2024 12:15:25 -0700
From: Vinicius Costa Gomes <vinicius.gomes@...el.com>
To: Christian Brauner <brauner@...nel.org>
Cc: amir73il@...il.com, hu1.chen@...el.com, miklos@...redi.hu,
 malini.bhandaru@...el.com, tim.c.chen@...el.com, mikko.ylinen@...el.com,
 lizhen.you@...el.com, linux-unionfs@...r.kernel.org,
 linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 0/3] overlayfs: Optimize override/revert creds

Christian Brauner <brauner@...nel.org> writes:

> On Tue, Apr 02, 2024 at 07:18:05PM -0700, Vinicius Costa Gomes wrote:
>> Hi,
>> 
>> Changes from RFC v3:
>>  - Removed the warning "fixes" patches, as they could hide potencial
>>    bugs (Christian Brauner);
>>  - Added "cred-specific" macros (Christian Brauner), from my side,
>>    added a few '_' to the guards to signify that the newly introduced
>>    helper macros are preferred.
>>  - Changed a few guard() to scoped_guard() to fix the clang (17.0.6)
>>    compilation error about 'goto' bypassing variable initialization;
>> 
>> Link to RFC v3:
>> 
>> https://lore.kernel.org/r/20240216051640.197378-1-vinicius.gomes@intel.com/
>> 
>> Changes from RFC v2:
>>  - Added separate patches for the warnings for the discarded const
>>    when using the cleanup macros: one for DEFINE_GUARD() and one for
>>    DEFINE_LOCK_GUARD_1() (I am uncertain if it's better to squash them
>>    together);
>>  - Reordered the series so the backing file patch is the first user of
>>    the introduced helpers (Amir Goldstein);
>>  - Change the definition of the cleanup "class" from a GUARD to a
>>    LOCK_GUARD_1, which defines an implicit container, that allows us
>>    to remove some variable declarations to store the overriden
>>    credentials (Amir Goldstein);
>>  - Replaced most of the uses of scoped_guard() with guard(), to reduce
>>    the code churn, the remaining ones I wasn't sure if I was changing
>>    the behavior: either they were nested (overrides "inside"
>>    overrides) or something calls current_cred() (Amir Goldstein).
>> 
>> New questions:
>>  - The backing file callbacks are now called with the "light"
>>    overriden credentials, so they are kind of restricted in what they
>>    can do with their credentials, is this acceptable in general?
>
> Until we grow additional users, I think yes. Just needs to be
> documented.
>

Will add some documentation for it, then.

>>  - in ovl_rename() I had to manually call the "light" the overrides,
>>    both using the guard() macro or using the non-light version causes
>>    the workload to crash the kernel. I still have to investigate why
>>    this is happening. Hints are appreciated.
>
> Do you have a reproducer? Do you have a splat from dmesg?

Just to be sure, with this version of the series the crash doesn't
happen. It was only happening when I was using the guard() macro
everywhere.

I just looked at my crash collection and couldn't find the splats, from
what I remember I lost connection to the machine, and wasn't able to
retrieve the splat.

I believe the crash and clang 17 compilation error point to the same
problem, that in ovl_rename() some 'goto' skips the declaration of the
(implicit) variable that the guard() macro generates. And it ends up
doing a revert_creds_light() on garbage memory when ovl_rename()
returns.

(if you want I can try and go back to "guard() everywhere" and try a bit
harder to get a splat)

Does that make sense?


Cheers,
-- 
Vinicius