On Thu, Feb 15, 2018 at 1:56 PM, Dan Williams dan.j.williams@intel.com wrote:
So I don't mind removing it, but I don't think it is garbage. It's there purely as a notification to the odd kernel developer that wants to pass "insane" index values,
But the thing is, the "index" value isn't even kernel-supplied.
Here's a test: run a 32-bit kernel, and then do an ioctl() or something with a negative fd.
What I think will happen is:
- the negative fd will be seen as a big 'unsigned int' here:
fcheck_files(struct files_struct *files, unsigned int fd)
which then does
fd = array_index_nospec(fd, fdt->max_fds);
and that existing *STUPID* and *WRONG* WARN_ON() will trigger.
Sure, you can't trigger it on 64-bit kernels because there the "unsigned int" will be small compared to LONG_MAX, but..
It is simply is *wrong* to check the "index". It really fundamentally is complete garbage.
Because the whole - and ONLY - *point* of this is that you have an untrusted index. So checking it and giving a warning when it's out of range is pure garbage.
Really. That warning must go away. Stop arguing for it, it's stupid and wrong.
Checking _size_ is one thing, but honestly, that's questionable too.
Linus