On Thu, Feb 15, 2018 at 2:03 PM, Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > On Thu, Feb 15, 2018 at 1:56 PM, Dan Williams <dan.j.williams@xxxxxxxxx> wrote: >> >> So I don't mind removing it, but I don't think it is garbage. It's >> there purely as a notification to the odd kernel developer that wants >> to pass "insane" index values, > > But the thing is, the "index" value isn't even kernel-supplied. > > Here's a test: run a 32-bit kernel, and then do an ioctl() or > something with a negative fd. > > What I think will happen is: > > - the negative fd will be seen as a big 'unsigned int' here: > > fcheck_files(struct files_struct *files, unsigned int fd) > > which then does > > fd = array_index_nospec(fd, fdt->max_fds); > > and that existing *STUPID* and *WRONG* WARN_ON() will trigger. > > Sure, you can't trigger it on 64-bit kernels because there the > "unsigned int" will be small compared to LONG_MAX, but.. > > It is simply is *wrong* to check the "index". It really fundamentally > is complete garbage. > > Because the whole - and ONLY - *point* of this is that you have an > untrusted index. So checking it and giving a warning when it's out of > range is pure garbage. > > Really. That warning must go away. Stop arguing for it, it's stupid and wrong. True, I had been myopically focused on the 64-bit case. > Checking _size_ is one thing, but honestly, that's questionable too. Nah, I'm not going to argue for that.