linux-kernel - Re: [PATCH] sysfs: check visibility before changing group attribute ownership

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <01070199eda55d65-1e43d600-4eb4-4caf-98f0-4414b449cb07-000000@eu-central-1.amazonses.com>
Date: Thu, 16 Oct 2025 15:31:01 +0000
From: Cynthia <cynthia@...mx.dev>
To: Greg KH <gregkh@...uxfoundation.org>, 
	Fernando Fernandez Mancera <fmancera@...e.de>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org, kuba@...nel.org, 
	rafael@...nel.org, dakr@...nel.org, christian.brauner@...ntu.com, 
	edumazet@...gle.com, pabeni@...hat.com, davem@...emloft.net, 
	horms@...nel.org
Subject: Re: [PATCH] sysfs: check visibility before changing group attribute
 ownership


On 10/16/25 16:46, Greg KH wrote:
> On Thu, Oct 16, 2025 at 12:14:56PM +0200, Fernando Fernandez Mancera wrote:
>> Since commit 0c17270f9b92 ("net: sysfs: Implement is_visible for
>> phys_(port_id, port_name, switch_id)"), __dev_change_net_namespace() can
>> hit WARN_ON() when trying to change owner of a file that isn't visible.
>> See the trace below:
>>
>>   WARNING: CPU: 6 PID: 2938 at net/core/dev.c:12410 __dev_change_net_namespace+0xb89/0xc30
>>   CPU: 6 UID: 0 PID: 2938 Comm: incusd Not tainted 6.17.1-1-mainline #1 PREEMPT(full)  4b783b4a638669fb644857f484487d17cb45ed1f
>>   Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.07 02/19/2025
>>   RIP: 0010:__dev_change_net_namespace+0xb89/0xc30
>>   [...]
>>   Call Trace:
>>    <TASK>
>>    ? if6_seq_show+0x30/0x50
>>    do_setlink.isra.0+0xc7/0x1270
>>    ? __nla_validate_parse+0x5c/0xcc0
>>    ? security_capable+0x94/0x1a0
>>    rtnl_newlink+0x858/0xc20
>>    ? update_curr+0x8e/0x1c0
>>    ? update_entity_lag+0x71/0x80
>>    ? sched_balance_newidle+0x358/0x450
>>    ? psi_task_switch+0x113/0x2a0
>>    ? __pfx_rtnl_newlink+0x10/0x10
>>    rtnetlink_rcv_msg+0x346/0x3e0
>>    ? sched_clock+0x10/0x30
>>    ? __pfx_rtnetlink_rcv_msg+0x10/0x10
>>    netlink_rcv_skb+0x59/0x110
>>    netlink_unicast+0x285/0x3c0
>>    ? __alloc_skb+0xdb/0x1a0
>>    netlink_sendmsg+0x20d/0x430
>>    ____sys_sendmsg+0x39f/0x3d0
>>    ? import_iovec+0x2f/0x40
>>    ___sys_sendmsg+0x99/0xe0
>>    __sys_sendmsg+0x8a/0xf0
>>    do_syscall_64+0x81/0x970
>>    ? __sys_bind+0xe3/0x110
>>    ? syscall_exit_work+0x143/0x1b0
>>    ? do_syscall_64+0x244/0x970
>>    ? sock_alloc_file+0x63/0xc0
>>    ? syscall_exit_work+0x143/0x1b0
>>    ? do_syscall_64+0x244/0x970
>>    ? alloc_fd+0x12e/0x190
>>    ? put_unused_fd+0x2a/0x70
>>    ? do_sys_openat2+0xa2/0xe0
>>    ? syscall_exit_work+0x143/0x1b0
>>    ? do_syscall_64+0x244/0x970
>>    ? exc_page_fault+0x7e/0x1a0
>>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>   [...]
>>    </TASK>
>>
>> Fix this by checking is_visible() before trying to touch the attribute.
>>
>> Fixes: 303a42769c4c ("sysfs: add sysfs_group{s}_change_owner()")
>> Reported-by: Cynthia <cynthia@...mx.dev>
>> Closes: https://lore.kernel.org/netdev/01070199e22de7f8-28f711ab-d3f1-46d9-b9a0-048ab05eb09b-000000@eu-central-1.amazonses.com/
>> Signed-off-by: Fernando Fernandez Mancera <fmancera@...e.de>
>> ---
>>   fs/sysfs/group.c | 26 +++++++++++++++++++++-----
>>   1 file changed, 21 insertions(+), 5 deletions(-)
> Nice, thanks!  This has been tested, right?
>
> thanks,
>
> greg k-h

I did a quick test just now, it works in the VM (no warn and the 
container is running).

kosmx