linux-kernel - Re: [PATCH v6 1/3] revocable: Add fops replacement

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aRGGARe6ExyGpaRh@google.com>
Date: Mon, 10 Nov 2025 06:28:17 +0000
From: Tzung-Bi Shih <tzungbi@...nel.org>
To: Jason Gunthorpe <jgg@...dia.com>
Cc: Benson Leung <bleung@...omium.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	"Rafael J . Wysocki" <rafael@...nel.org>,
	Danilo Krummrich <dakr@...nel.org>,
	Jonathan Corbet <corbet@....net>, Shuah Khan <shuah@...nel.org>,
	linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
	chrome-platform@...ts.linux.dev, linux-kselftest@...r.kernel.org,
	Laurent Pinchart <laurent.pinchart@...asonboard.com>,
	Bartosz Golaszewski <brgl@...ev.pl>,
	Wolfram Sang <wsa+renesas@...g-engineering.com>,
	Simona Vetter <simona.vetter@...ll.ch>,
	Dan Williams <dan.j.williams@...el.com>
Subject: Re: [PATCH v6 1/3] revocable: Add fops replacement

On Fri, Nov 07, 2025 at 10:15:09AM -0400, Jason Gunthorpe wrote:
> On Fri, Nov 07, 2025 at 05:07:54AM +0000, Tzung-Bi Shih wrote:
> > On Thu, Nov 06, 2025 at 11:47:15AM -0400, Jason Gunthorpe wrote:
> > > On Thu, Nov 06, 2025 at 11:27:10PM +0800, Tzung-Bi Shih wrote:
> > > > +/*
> > > > + * Recover the private_data to its original one.
> > > > + */
> > > > +static struct fops_replacement *_recover_private_data(struct file *filp)
> > > > +{
> > > > +	struct fops_replacement *fr = filp->private_data;
> > > > +
> > > > +	filp->private_data = fr->orig_private_data;
> > > > +	return fr;
> > > > +}
> > > > +
> > > > +/*
> > > > + * Replace the private_data to fops_replacement.
> > > > + */
> > > > +static void _replace_private_data(struct fops_replacement *fr)
> > > > +{
> > > > +	fr->filp->private_data = fr;
> > > > +}
> > > 
> > > This switching of private_data isn't reasonable, it breaks too much
> > > stuff. I think I showed a better idea in my sketch.
> > 
> > The approach assumes the filp->private_data should be set once by the
> > filp->f_op->open() if any.  Is it common that the filp->private_data
> > be updated in other file operations?
> 
> You can set it once during open, but you can't change it around every
> fops callback. This stuff is all concurrent.

Ah, yes, I see.

> > > This probably doesn't work out, is likely to make a memory leak.
> > > It will be hard for the owning driver to free its per-file memory
> > > without access to release.
> > 
> > Ah, I think this reveals a drawback of the approach.
> > - Without calling ->release(), some memory may leak.
> > - With calling ->release(), some UAF may happen. 
> 
> It just means the user of this needs to understand there are
> limitations on what release can do. Usually release just frees memory,
> that is fine.
> 
> I think it would be strange for a release to touch revocable data,
> that might suggest some larger problem.

I think it'd be inevitable for accessing some devm memory in ->release(),
e.g. [1].

[1] https://elixir.bootlin.com/linux/v6.17/source/drivers/platform/chrome/cros_ec_chardev.c#L260