linux-kernel - Re: [PATCH] signal: restore the override

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241103165048.GA11668@redhat.com>
Date: Sun, 3 Nov 2024 17:50:49 +0100
From: Oleg Nesterov <oleg@...hat.com>
To: Alexey Gladkov <legion@...nel.org>
Cc: Andrei Vagin <avagin@...gle.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Roman Gushchin <roman.gushchin@...ux.dev>,
	linux-kernel@...r.kernel.org, Kees Cook <kees@...nel.org>,
	stable@...r.kernel.org
Subject: Re: [PATCH] signal: restore the override_rlimit logic

On 11/02, Alexey Gladkov wrote:
>
> +Cc Oleg Nesterov.

Well, I tend to agree with Roman and his patch looks good to me.

But it seems that the change in inc_rlimit_get_ucounts() can be
a bit simpler and more readable, see below.

Oleg.
---

--- a/kernel/ucount.c
+++ b/kernel/ucount.c
@@ -307,7 +307,8 @@ void dec_rlimit_put_ucounts(struct ucounts *ucounts, enum rlimit_type type)
 	do_dec_rlimit_put_ucounts(ucounts, NULL, type);
 }
 
-long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type)
+long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type,
+			    bool override_rlimit)
 {
 	/* Caller must hold a reference to ucounts */
 	struct ucounts *iter;
@@ -320,7 +321,8 @@ long inc_rlimit_get_ucounts(struct ucounts *ucounts, enum rlimit_type type)
 			goto unwind;
 		if (iter == ucounts)
 			ret = new;
-		max = get_userns_rlimit_max(iter->ns, type);
+		if (!override_rlimit)
+			max = get_userns_rlimit_max(iter->ns, type);
 		/*
 		 * Grab an extra ucount reference for the caller when
 		 * the rlimit count was previously 0.