linux-kernel - Re: [PATCH v6 1/3] revocable: Add fops replacement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251106154715.GB1732817@nvidia.com>
Date: Thu, 6 Nov 2025 11:47:15 -0400
From: Jason Gunthorpe <jgg@...dia.com>
To: Tzung-Bi Shih <tzungbi@...nel.org>
Cc: Benson Leung <bleung@...omium.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	"Rafael J . Wysocki" <rafael@...nel.org>,
	Danilo Krummrich <dakr@...nel.org>,
	Jonathan Corbet <corbet@....net>, Shuah Khan <shuah@...nel.org>,
	linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
	chrome-platform@...ts.linux.dev, linux-kselftest@...r.kernel.org,
	Laurent Pinchart <laurent.pinchart@...asonboard.com>,
	Bartosz Golaszewski <brgl@...ev.pl>,
	Wolfram Sang <wsa+renesas@...g-engineering.com>,
	Simona Vetter <simona.vetter@...ll.ch>,
	Dan Williams <dan.j.williams@...el.com>
Subject: Re: [PATCH v6 1/3] revocable: Add fops replacement

On Thu, Nov 06, 2025 at 11:27:10PM +0800, Tzung-Bi Shih wrote:
> +/*
> + * Recover the private_data to its original one.
> + */
> +static struct fops_replacement *_recover_private_data(struct file *filp)
> +{
> +	struct fops_replacement *fr = filp->private_data;
> +
> +	filp->private_data = fr->orig_private_data;
> +	return fr;
> +}
> +
> +/*
> + * Replace the private_data to fops_replacement.
> + */
> +static void _replace_private_data(struct fops_replacement *fr)
> +{
> +	fr->filp->private_data = fr;
> +}

This switching of private_data isn't reasonable, it breaks too much
stuff. I think I showed a better idea in my sketch.

I still think this is a bad use case of revocable, we don't need to
obfuscate very simple locks in *core* kernel code like this. I'd rather
see you propose this series without using it.

> +static int fs_revocable_release(struct inode *inode, struct file *filp)
> +{
> +	struct fops_replacement *fr = _recover_private_data(filp);
> +	int ret = 0;
> +	void *any;
> +
> +	filp->f_op = fr->orig_fops;
> +
> +	if (!fr->orig_fops->release)
> +		goto leave;
> +
> +	REVOCABLE_TRY_ACCESS_SCOPED(fr->rev, any) {
> +		if (!any) {
> +			ret = -ENODEV;
> +			goto leave;
> +		}
> +
> +		ret = fr->orig_fops->release(inode, filp);
> +	}

This probably doesn't work out, is likely to make a memory leak.
It will be hard for the owning driver to free its per-file memory
without access to release.

Jason