linux-kernel - Re: [PATCH] smb/client: use sock_create_kern() in generic_ip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250528082614.5ee971d1@pumpkin>
Date: Wed, 28 May 2025 08:26:14 +0100
From: David Laight <david.laight.linux@...il.com>
To: ChenXiaoSong <chenxiaosong@...nxiaosong.com>
Cc: Steve French <smfrench@...il.com>, Kuniyuki Iwashima
 <kuniyu@...zon.com>, pc@...guebit.com, ronniesahlberg@...il.com,
 sprasad@...rosoft.com, tom@...pey.com, bharathsm@...rosoft.com,
 linux-cifs@...r.kernel.org, linux-kernel@...r.kernel.org, ChenXiaoSong
 <chenxiaosong@...inos.cn>, Wang Zhaolong <wangzhaolong1@...wei.com>, Enzo
 Matsumiya <ematsumiya@...e.de>
Subject: Re: [PATCH] smb/client: use sock_create_kern() in
 generic_ip_connect()

On Wed, 28 May 2025 12:09:01 +0800
ChenXiaoSong <chenxiaosong@...nxiaosong.com> wrote:
> 在 2025/5/28 11:39, Steve French 写道:
> > Weren't there issues brought up earlier with using sock_create_kern
> > due to network namespaces and refcounts?

> This patch is simply a cleanup that wraps the original code for 
> explicitness, the last argument of __sock_create(..., 1) specifies that 
> the socket is created in kernel space.

Except that 'kernel space' doesn't really mean anything.
IIRC it does two separate things:
1) Skips some 'permission' checks on the current process.
2) Doesn't 'hold' the network namespace.

The extra permission checks might be relevant even if the socket is
only indirectly accessible from a process.

But code like smb doesn't want the extra checks but does need the
namespace held (or it has to go through 'hoops' to request a callback
when the namespace is removed and delete the connection from the
callback).

Maybe there should be a 'kernel_socket()' (cf kernel_sendmsg()) that
code like smb should use.

	David


> 
> > 
> > On Tue, May 27, 2025 at 10:18 PM <chenxiaosong@...nxiaosong.com> wrote:  
> >>
> >> From: ChenXiaoSong <chenxiaosong@...inos.cn>
> >>
> >> Change __sock_create() to sock_create_kern() for explicitness.
> >>
> >> Signed-off-by: ChenXiaoSong <chenxiaosong@...inos.cn>
> >> ---
> >>   fs/smb/client/connect.c | 3 +--
> >>   1 file changed, 1 insertion(+), 2 deletions(-)
> >>
> >> diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c
> >> index 6bf04d9a5491..3275f2ff84cb 100644
> >> --- a/fs/smb/client/connect.c
> >> +++ b/fs/smb/client/connect.c
> >> @@ -3350,8 +3350,7 @@ generic_ip_connect(struct TCP_Server_Info *server)
> >>                  struct net *net = cifs_net_ns(server);
> >>                  struct sock *sk;
> >>
> >> -               rc = __sock_create(net, sfamily, SOCK_STREAM,
> >> -                                  IPPROTO_TCP, &server->ssocket, 1);
> >> +               rc = sock_create_kern(net, sfamily, SOCK_STREAM, IPPROTO_TCP, &server->ssocket);
> >>                  if (rc < 0) {
> >>                          cifs_server_dbg(VFS, "Error %d creating socket\n", rc);
> >>                          return rc;
> >> --
> >> 2.34.1
> >>
> >>  
> > 
> >   
> 
>