netdev - Re: [PATCH] sysfs: check visibility before changing group attribute ownership

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <44c3937c-bf63-4e5f-a821-6c9adb4faf48@suse.de>
Date: Fri, 17 Oct 2025 01:17:41 +0200
From: Fernando Fernandez Mancera <fmancera@...e.de>
To: Cynthia <cynthia@...mx.dev>, Greg KH <gregkh@...uxfoundation.org>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org, kuba@...nel.org,
 rafael@...nel.org, dakr@...nel.org, christian.brauner@...ntu.com,
 edumazet@...gle.com, pabeni@...hat.com, davem@...emloft.net, horms@...nel.org
Subject: Re: [PATCH] sysfs: check visibility before changing group attribute
 ownership



On 10/16/25 5:31 PM, Cynthia wrote:
> [...]
>>>    ? psi_task_switch+0x113/0x2a0
>>>    ? __pfx_rtnl_newlink+0x10/0x10
>>>    rtnetlink_rcv_msg+0x346/0x3e0
>>>    ? sched_clock+0x10/0x30
>>>    ? __pfx_rtnetlink_rcv_msg+0x10/0x10
>>>    netlink_rcv_skb+0x59/0x110
>>>    netlink_unicast+0x285/0x3c0
>>>    ? __alloc_skb+0xdb/0x1a0
>>>    netlink_sendmsg+0x20d/0x430
>>>    ____sys_sendmsg+0x39f/0x3d0
>>>    ? import_iovec+0x2f/0x40
>>>    ___sys_sendmsg+0x99/0xe0
>>>    __sys_sendmsg+0x8a/0xf0
>>>    do_syscall_64+0x81/0x970
>>>    ? __sys_bind+0xe3/0x110
>>>    ? syscall_exit_work+0x143/0x1b0
>>>    ? do_syscall_64+0x244/0x970
>>>    ? sock_alloc_file+0x63/0xc0
>>>    ? syscall_exit_work+0x143/0x1b0
>>>    ? do_syscall_64+0x244/0x970
>>>    ? alloc_fd+0x12e/0x190
>>>    ? put_unused_fd+0x2a/0x70
>>>    ? do_sys_openat2+0xa2/0xe0
>>>    ? syscall_exit_work+0x143/0x1b0
>>>    ? do_syscall_64+0x244/0x970
>>>    ? exc_page_fault+0x7e/0x1a0
>>>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>>   [...]
>>>    </TASK>
>>>
>>> Fix this by checking is_visible() before trying to touch the attribute.
>>>
>>> Fixes: 303a42769c4c ("sysfs: add sysfs_group{s}_change_owner()")
>>> Reported-by: Cynthia <cynthia@...mx.dev>
>>> Closes: https://lore.kernel.org/netdev/01070199e22de7f8-28f711ab- 
>>> d3f1-46d9-b9a0-048ab05eb09b-000000@...central-1.amazonses.com/
>>> Signed-off-by: Fernando Fernandez Mancera <fmancera@...e.de>
>>> ---
>>>   fs/sysfs/group.c | 26 +++++++++++++++++++++-----
>>>   1 file changed, 21 insertions(+), 5 deletions(-)
>> Nice, thanks!  This has been tested, right?
>>
>> thanks,
>>
>> greg k-h
> 
> I did a quick test just now, it works in the VM (no warn and the 
> container is running).
> 

Same here, I tested it while doing the patch using the reproducer 
provided on the report.

Thanks,
Fernando.