| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20251016054204.1523139-6-tzungbi@kernel.org>
Date: Thu, 16 Oct 2025 05:42:02 +0000
From: Tzung-Bi Shih <tzungbi@...nel.org>
To: Benson Leung <bleung@...omium.org>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
"Rafael J . Wysocki" <rafael@...nel.org>,
Danilo Krummrich <dakr@...nel.org>
Cc: Jonathan Corbet <corbet@....net>,
Shuah Khan <shuah@...nel.org>,
linux-doc@...r.kernel.org,
linux-kernel@...r.kernel.org,
chrome-platform@...ts.linux.dev,
linux-kselftest@...r.kernel.org,
tzungbi@...nel.org,
Laurent Pinchart <laurent.pinchart@...asonboard.com>,
Bartosz Golaszewski <brgl@...ev.pl>,
Wolfram Sang <wsa+renesas@...g-engineering.com>,
Simona Vetter <simona.vetter@...ll.ch>,
Dan Williams <dan.j.williams@...el.com>,
Jason Gunthorpe <jgg@...dia.com>
Subject: [PATCH v5 5/7] revocable: Add fops replacement
Introduce fs_revocable_replace() to simplify the use of the revocable
API with file_operations.
The function, should be called from a driver's ->open(), replaces the
fops with a wrapper that automatically handles the `try_access` and
`withdraw_access`.
When the file is closed, the wrapper's ->release() restores the original
fops and cleanups. This centralizes the revocable logic, making drivers
cleaner and easier to maintain.
Signed-off-by: Tzung-Bi Shih <tzungbi@...nel.org>
---
PoC patch.
Known issues:
- All file operations call revocable_try_access() for guaranteeing the
resource even if the resource may be unused in the fops.
v5:
- Rename to "fs_revocable".
- Move the replacement context to struct file.
- Support multiple revocable providers.
v4: https://lore.kernel.org/chrome-platform/20250923075302.591026-6-tzungbi@kernel.org
- New in the series.
fs/Makefile | 2 +-
fs/fs_revocable.c | 154 +++++++++++++++++++++++++++++++++++
include/linux/fs.h | 2 +
include/linux/fs_revocable.h | 21 +++++
4 files changed, 178 insertions(+), 1 deletion(-)
create mode 100644 fs/fs_revocable.c
create mode 100644 include/linux/fs_revocable.h
diff --git a/fs/Makefile b/fs/Makefile
index e3523ab2e587..ec2b21385deb 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -16,7 +16,7 @@ obj-y := open.o read_write.o file_table.o super.o \
stack.o fs_struct.o statfs.o fs_pin.o nsfs.o \
fs_types.o fs_context.o fs_parser.o fsopen.o init.o \
kernel_read_file.o mnt_idmapping.o remap_range.o pidfs.o \
- file_attr.o
+ file_attr.o fs_revocable.o
obj-$(CONFIG_BUFFER_HEAD) += buffer.o mpage.o
obj-$(CONFIG_PROC_FS) += proc_namespace.o
diff --git a/fs/fs_revocable.c b/fs/fs_revocable.c
new file mode 100644
index 000000000000..4b6d755abfed
--- /dev/null
+++ b/fs/fs_revocable.c
@@ -0,0 +1,154 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2025 Google LLC
+ *
+ * File operation replacement with Revocable
+ */
+
+#include <linux/cleanup.h>
+#include <linux/fs_revocable.h>
+#include <linux/poll.h>
+#include <linux/revocable.h>
+
+struct fs_revocable_replacement {
+ const struct fs_revocable_operations *frops;
+ const struct file_operations *orig_fops;
+ struct file_operations fops;
+ struct revocable **revs;
+ size_t num_revs;
+};
+
+static int fs_revocable_try_access(struct file *filp)
+{
+ struct fs_revocable_replacement *rr = filp->f_rr;
+
+ return rr->frops->try_access(rr->revs, rr->num_revs,
+ filp->private_data);
+}
+
+static void fs_revocable_withdraw_access(struct fs_revocable_replacement *rr)
+{
+ for (size_t i = 0; i < rr->num_revs; ++i)
+ revocable_withdraw_access(rr->revs[i]);
+}
+
+DEFINE_FREE(fs_revocable_replacement, struct fs_revocable_replacement *,
+ if (_T) fs_revocable_withdraw_access(_T))
+
+static ssize_t fs_revocable_read(struct file *filp, char __user *buffer,
+ size_t length, loff_t *offset)
+{
+ struct fs_revocable_replacement *rr
+ __free(fs_revocable_replacement) = filp->f_rr;
+ int ret;
+
+ ret = fs_revocable_try_access(filp);
+ if (ret)
+ return ret;
+ return rr->orig_fops->read(filp, buffer, length, offset);
+}
+
+static __poll_t fs_revocable_poll(struct file *filp, poll_table *wait)
+{
+ struct fs_revocable_replacement *rr
+ __free(fs_revocable_replacement) = filp->f_rr;
+ int ret;
+
+ ret = fs_revocable_try_access(filp);
+ if (ret)
+ return ret;
+ return rr->orig_fops->poll(filp, wait);
+}
+
+static long fs_revocable_unlocked_ioctl(struct file *filp, unsigned int cmd,
+ unsigned long arg)
+{
+ struct fs_revocable_replacement *rr
+ __free(fs_revocable_replacement) = filp->f_rr;
+ int ret;
+
+ ret = fs_revocable_try_access(filp);
+ if (ret)
+ return ret;
+ return rr->orig_fops->unlocked_ioctl(filp, cmd, arg);
+}
+
+static int fs_revocable_release(struct inode *inode, struct file *filp)
+{
+ int ret = 0;
+ struct fs_revocable_replacement *rr = filp->f_rr;
+
+ if (!rr->orig_fops->release)
+ goto recover;
+
+ ret = fs_revocable_try_access(filp);
+ if (ret)
+ goto recover;
+
+ ret = rr->orig_fops->release(inode, filp);
+
+ fs_revocable_withdraw_access(rr);
+recover:
+ filp->f_op = rr->orig_fops;
+ filp->f_rr = NULL;
+
+ for (size_t i = 0; i < rr->num_revs; ++i)
+ revocable_free(rr->revs[i]);
+ kfree(rr->revs);
+ kfree(rr);
+
+ return ret;
+}
+
+/**
+ * fs_revocable_replace() - Replace the file operations to be revocable-aware.
+ *
+ * Should be used only from ->open() instances.
+ */
+int fs_revocable_replace(struct file *filp,
+ const struct fs_revocable_operations *frops,
+ struct revocable_provider **rps, size_t num_rps)
+{
+ struct fs_revocable_replacement *rr;
+ size_t i;
+
+ rr = kzalloc(sizeof(*rr), GFP_KERNEL);
+ if (!rr)
+ return -ENOMEM;
+ filp->f_rr = rr;
+
+ rr->frops = frops;
+ rr->revs = kcalloc(num_rps, sizeof(*rr->revs), GFP_KERNEL);
+ if (!rr->revs)
+ goto free_rr;
+ for (i = 0; i < num_rps; ++i) {
+ rr->revs[i] = revocable_alloc(rps[i]);
+ if (!rr->revs[i])
+ goto free_revs;
+ }
+ rr->num_revs = num_rps;
+ rr->orig_fops = filp->f_op;
+
+ memcpy(&rr->fops, filp->f_op, sizeof(rr->fops));
+ rr->fops.release = fs_revocable_release;
+
+ if (rr->fops.read)
+ rr->fops.read = fs_revocable_read;
+ if (rr->fops.poll)
+ rr->fops.poll = fs_revocable_poll;
+ if (rr->fops.unlocked_ioctl)
+ rr->fops.unlocked_ioctl = fs_revocable_unlocked_ioctl;
+
+ filp->f_op = &rr->fops;
+ return 0;
+free_revs:
+ if (i) {
+ while (--i)
+ revocable_free(rr->revs[i]);
+ }
+ kfree(rr->revs);
+free_rr:
+ kfree(rr);
+ return -ENOMEM;
+}
+EXPORT_SYMBOL_GPL(fs_revocable_replace);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 68c4a59ec8fb..a03dd7f343a9 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -80,6 +80,7 @@ struct fs_context;
struct fs_parameter_spec;
struct file_kattr;
struct iomap_ops;
+struct fs_revocable_replacement;
extern void __init inode_init(void);
extern void __init inode_init_early(void);
@@ -1248,6 +1249,7 @@ struct file {
};
file_ref_t f_ref;
/* --- cacheline 3 boundary (192 bytes) --- */
+ struct fs_revocable_replacement *f_rr;
} __randomize_layout
__attribute__((aligned(4))); /* lest something weird decides that 2 is OK */
diff --git a/include/linux/fs_revocable.h b/include/linux/fs_revocable.h
new file mode 100644
index 000000000000..bb066392d232
--- /dev/null
+++ b/include/linux/fs_revocable.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright 2025 Google LLC
+ */
+
+#ifndef __LINUX_FS_REVOCABLE_H
+#define __LINUX_FS_REVOCABLE_H
+
+#include <linux/fs.h>
+#include <linux/revocable.h>
+
+struct fs_revocable_operations {
+ int (*try_access)(struct revocable **revs, size_t num_revs, void *data);
+};
+
+int fs_revocable_replace(struct file *filp,
+ const struct fs_revocable_operations *frops,
+ struct revocable_provider **rps, size_t num_rps);
+
+#endif /* __LINUX_FS_REVOCABLE_H */
--
2.51.0.788.g6d19910ace-goog
Powered by blists - more mailing lists