On Thu, Feb 15, 2018 at 1:56 PM, Dan Williams <dan.j.williams@xxxxxxxxx> wrote:
>
> So I don't mind removing it, but I don't think it is garbage. It's
> there purely as a notification to the odd kernel developer that wants
> to pass "insane" index values,
But the thing is, the "index" value isn't even kernel-supplied.
Here's a test: run a 32-bit kernel, and then do an ioctl() or
something with a negative fd.
What I think will happen is:
- the negative fd will be seen as a big 'unsigned int' here:
fcheck_files(struct files_struct *files, unsigned int fd)
which then does
fd = array_index_nospec(fd, fdt->max_fds);
and that existing *STUPID* and *WRONG* WARN_ON() will trigger.
Sure, you can't trigger it on 64-bit kernels because there the
"unsigned int" will be small compared to LONG_MAX, but..
It is simply is *wrong* to check the "index". It really fundamentally
is complete garbage.
Because the whole - and ONLY - *point* of this is that you have an
untrusted index. So checking it and giving a warning when it's out of
range is pure garbage.
Really. That warning must go away. Stop arguing for it, it's stupid and wrong.
Checking _size_ is one thing, but honestly, that's questionable too.
Linus