linux-kernel - Re: [GIT PULL 08/17 for v6.19] cred guards

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aS5AS-rzQfFeK94L@laps>
Date: Mon, 1 Dec 2025 20:26:35 -0500
From: Sasha Levin <sashal@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Christian Brauner <brauner@...nel.org>,
	Mike Snitzer <snitzer@...nel.org>, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL 08/17 for v6.19] cred guards

On Mon, Dec 01, 2025 at 01:53:02PM -0800, Linus Torvalds wrote:
>On Fri, 28 Nov 2025 at 08:51, Christian Brauner <brauner@...nel.org> wrote:
>>
>> Merge conflicts with mainline
>>
>> diff --cc fs/nfs/localio.c
>
>So I ended up merging this very differently from  how you did it.
>
>I just wrapped 'nfs_local_call_read()' for the cred guarding the same
>way the 'nfs_local_call_write()' side had been done.
>
>That made it much easier to see that the changes by Mike were carried
>over, and seems cleaner anyway.
>
>But it would be good if people double-checked my change. It looks
>"ObviouslyCorrect(tm)" to me, but...

A minor nit:

	+ static void nfs_local_call_write(struct work_struct *work)
	+ {
	+       struct nfs_local_kiocb *iocb =
	+               container_of(work, struct nfs_local_kiocb, work);
	+       struct file *filp = iocb->kiocb.ki_filp;
	+       unsigned long old_flags = current->flags;
	+       ssize_t status;
	+ 
	+       current->flags |= PF_LOCAL_THROTTLE | PF_MEMALLOC_NOIO;
	+ 
	+       scoped_with_creds(filp->f_cred)
	+               status = do_nfs_local_call_write(iocb, filp);
	+ 
	        current->flags = old_flags;
	 -
	 -      if (status != -EIOCBQUEUED) {
	 -              nfs_local_write_done(iocb, status);
	 -              nfs_local_vfs_getattr(iocb);
	 -              nfs_local_pgio_release(iocb);
	 -      }
	  }

With the change above, `status` should have been dropped altogether.

I'll send a patch...

-- 
Thanks,
Sasha