[PATCHSET][RFC] struct fd and memory safety · Al Viro <viro@zeniv.linux.org.uk> · 2024-07-30
[PATCH 01/39] memcg_write_event_control(): fix a user-triggerable oops · viro@kernel.org · 2024-07-30
[PATCH 02/39] introduce fd_file(), convert all accessors to it. · viro@kernel.org · 2024-07-30
Re: [PATCH 02/39] introduce fd_file(), convert all accessors to it. · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 03/39] struct fd: representation change · viro@kernel.org · 2024-07-30
Re: [PATCH 03/39] struct fd: representation change · Josef Bacik <josef@toxicpanda.com> · 2024-07-30
Re: [PATCH 03/39] struct fd: representation change · Christian Brauner <brauner@kernel.org> · 2024-08-07
Re: [PATCH 03/39] struct fd: representation change · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 04/39] add struct fd constructors, get rid of __to_fd() · viro@kernel.org · 2024-07-30
Re: [PATCH 04/39] add struct fd constructors, get rid of __to_fd() · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 05/39] regularize emptiness checks in fini_module(2) and vfs_dedupe_file_range() · viro@kernel.org · 2024-07-30
Re: [PATCH 05/39] regularize emptiness checks in fini_module(2) and vfs_dedupe_file_range() · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 06/39] net/socket.c: switch to CLASS(fd) · viro@kernel.org · 2024-07-30
Re: [PATCH 06/39] net/socket.c: switch to CLASS(fd) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 07/39] introduce struct fderr, convert overlayfs uses to that · viro@kernel.org · 2024-07-30
[PATCH 08/39] experimental: convert fs/overlayfs/file.c to CLASS(...) · viro@kernel.org · 2024-07-30
Re: [PATCH 08/39] experimental: convert fs/overlayfs/file.c to CLASS(...) · Josef Bacik <josef@toxicpanda.com> · 2024-07-30
Re: [PATCH 08/39] experimental: convert fs/overlayfs/file.c to CLASS(...) · Al Viro <viro@zeniv.linux.org.uk> · 2024-07-30
Re: [PATCH 08/39] experimental: convert fs/overlayfs/file.c to CLASS(...) · Josef Bacik <josef@toxicpanda.com> · 2024-07-31
Re: [PATCH 08/39] experimental: convert fs/overlayfs/file.c to CLASS(...) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 09/39] timerfd: switch to CLASS(fd, ...) · viro@kernel.org · 2024-07-30
Re: [PATCH 09/39] timerfd: switch to CLASS(fd, ...) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 10/39] get rid of perf_fget_light(), convert kernel/events/core.c to CLASS(fd) · viro@kernel.org · 2024-07-30
Re: [PATCH 10/39] get rid of perf_fget_light(), convert kernel/events/core.c to CLASS(fd) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 11/39] switch netlink_getsockbyfilp() to taking descriptor · viro@kernel.org · 2024-07-30
Re: [PATCH 11/39] switch netlink_getsockbyfilp() to taking descriptor · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 12/39] do_mq_notify(): saner skb freeing on failures · viro@kernel.org · 2024-07-30
[PATCH 13/39] do_mq_notify(): switch to CLASS(fd, ...) · viro@kernel.org · 2024-07-30
Re: [PATCH 13/39] do_mq_notify(): switch to CLASS(fd, ...) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 14/39] simplify xfs_find_handle() a bit · viro@kernel.org · 2024-07-30
[PATCH 15/39] convert vmsplice() to CLASS(fd, ...) · viro@kernel.org · 2024-07-30
Re: [PATCH 15/39] convert vmsplice() to CLASS(fd, ...) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 16/39] convert __bpf_prog_get() to CLASS(fd, ...) · viro@kernel.org · 2024-07-30
Re: [PATCH 16/39] convert __bpf_prog_get() to CLASS(fd, ...) · Andrii Nakryiko <hidden> · 2024-08-06
Re: [PATCH 16/39] convert __bpf_prog_get() to CLASS(fd, ...) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · viro@kernel.org · 2024-07-30
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Andrii Nakryiko <hidden> · 2024-08-06
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Christian Brauner <brauner@kernel.org> · 2024-08-07
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Andrii Nakryiko <hidden> · 2024-08-07
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Alexei Starovoitov <hidden> · 2024-08-08
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Andrii Nakryiko <hidden> · 2024-08-08
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Alexei Starovoitov <hidden> · 2024-08-09
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Andrii Nakryiko <hidden> · 2024-08-09
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Al Viro <viro@zeniv.linux.org.uk> · 2024-08-10
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Andrii Nakryiko <hidden> · 2024-08-12
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Al Viro <viro@zeniv.linux.org.uk> · 2024-08-13
Re: [PATCH 17/39] bpf: resolve_pseudo_ldimm64(): take handling of a single ldimm64 insn into helper · Andrii Nakryiko <hidden> · 2024-08-13
[PATCH 18/39] bpf maps: switch to CLASS(fd, ...) · viro@kernel.org · 2024-07-30
Re: [PATCH 18/39] bpf maps: switch to CLASS(fd, ...) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 19/39] fdget_raw() users: switch to CLASS(fd_raw, ...) · viro@kernel.org · 2024-07-30
Re: [PATCH 19/39] fdget_raw() users: switch to CLASS(fd_raw, ...) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 20/39] introduce "fd_pos" class, convert fdget_pos() users to it. · viro@kernel.org · 2024-07-30
Re: [PATCH 20/39] introduce "fd_pos" class, convert fdget_pos() users to it. · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 21/39] o2hb_region_dev_store(): avoid goto around fdget()/fdput() · viro@kernel.org · 2024-07-30
[PATCH 22/39] privcmd_ioeventfd_assign(): don't open-code eventfd_ctx_fdget() · viro@kernel.org · 2024-07-30
[PATCH 23/39] fdget(), trivial conversions · viro@kernel.org · 2024-07-30
Re: [PATCH 23/39] fdget(), trivial conversions · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 24/39] fdget(), more trivial conversions · viro@kernel.org · 2024-07-30
Re: [PATCH 24/39] fdget(), more trivial conversions · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 25/39] convert do_preadv()/do_pwritev() · viro@kernel.org · 2024-07-30
Re: [PATCH 25/39] convert do_preadv()/do_pwritev() · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 26/39] convert cachestat(2) · viro@kernel.org · 2024-07-30
Re: [PATCH 26/39] convert cachestat(2) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 27/39] switch spufs_calls_{get,put}() to CLASS() use · viro@kernel.org · 2024-07-30
[PATCH 28/39] convert spu_run(2) · viro@kernel.org · 2024-07-30
Re: [PATCH 28/39] convert spu_run(2) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 29/39] convert media_request_get_by_fd() · viro@kernel.org · 2024-07-30
Re: [PATCH 29/39] convert media_request_get_by_fd() · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 30/39] convert coda_parse_fd() · viro@kernel.org · 2024-07-30
Re: [PATCH 30/39] convert coda_parse_fd() · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 31/39] convert cifs_ioctl_copychunk() · viro@kernel.org · 2024-07-30
Re: [PATCH 31/39] convert cifs_ioctl_copychunk() · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 32/39] convert vfs_dedupe_file_range(). · viro@kernel.org · 2024-07-30
Re: [PATCH 32/39] convert vfs_dedupe_file_range(). · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 33/39] convert do_select() · viro@kernel.org · 2024-07-30
Re: [PATCH 33/39] convert do_select() · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 34/39] do_pollfd(): convert to CLASS(fd) · viro@kernel.org · 2024-07-30
Re: [PATCH 34/39] do_pollfd(): convert to CLASS(fd) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 35/39] convert bpf_token_create() · viro@kernel.org · 2024-07-30
Re: [PATCH 35/39] convert bpf_token_create() · Andrii Nakryiko <hidden> · 2024-08-06
Re: [PATCH 35/39] convert bpf_token_create() · Al Viro <viro@zeniv.linux.org.uk> · 2024-08-10
Re: [PATCH 35/39] convert bpf_token_create() · Andrii Nakryiko <hidden> · 2024-08-12
Re: [PATCH 35/39] convert bpf_token_create() · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 36/39] assorted variants of irqfd setup: convert to CLASS(fd) · viro@kernel.org · 2024-07-30
Re: [PATCH 36/39] assorted variants of irqfd setup: convert to CLASS(fd) · Christian Brauner <brauner@kernel.org> · 2024-08-07
Re: [PATCH 36/39] assorted variants of irqfd setup: convert to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-08-10
[PATCH 37/39] memcg_write_event_control(): switch to CLASS(fd) · viro@kernel.org · 2024-07-30
Re: [PATCH 37/39] memcg_write_event_control(): switch to CLASS(fd) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 38/39] css_set_fork(): switch to CLASS(fd_raw, ...) · viro@kernel.org · 2024-07-30
Re: [PATCH 38/39] css_set_fork(): switch to CLASS(fd_raw, ...) · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCH 39/39] deal with the last remaing boolean uses of fd_file() · viro@kernel.org · 2024-07-30
Re: [PATCH 39/39] deal with the last remaing boolean uses of fd_file() · Christian Brauner <brauner@kernel.org> · 2024-08-07
Re: [PATCH 01/39] memcg_write_event_control(): fix a user-triggerable oops · Michal Hocko <mhocko@suse.com> · 2024-07-30
Re: [PATCH 01/39] memcg_write_event_control(): fix a user-triggerable oops · Al Viro <viro@zeniv.linux.org.uk> · 2024-07-30
Re: [PATCH 01/39] memcg_write_event_control(): fix a user-triggerable oops · Michal Hocko <mhocko@suse.com> · 2024-07-30
Re: [PATCHSET][RFC] struct fd and memory safety · Al Viro <viro@zeniv.linux.org.uk> · 2024-07-30
Re: [PATCHSET][RFC] struct fd and memory safety · Josef Bacik <josef@toxicpanda.com> · 2024-07-30
Re: [PATCHSET][RFC] struct fd and memory safety · Al Viro <viro@zeniv.linux.org.uk> · 2024-07-31
Re: [PATCHSET][RFC] struct fd and memory safety · Jason Gunthorpe <jgg@ziepe.ca> · 2024-08-06
Re: [PATCHSET][RFC] struct fd and memory safety · Al Viro <viro@zeniv.linux.org.uk> · 2024-08-06
Re: [PATCHSET][RFC] struct fd and memory safety · Christian Brauner <brauner@kernel.org> · 2024-08-07
[PATCHSET v3] struct fd and memory safety · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 01/28] net/socket.c: switch to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 07/28] do_mq_notify(): switch to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 05/28] switch netlink_getsockbyfilp() to taking descriptor · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 09/28] convert vmsplice() to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 08/28] simplify xfs_find_handle() a bit · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 12/28] o2hb_region_dev_store(): avoid goto around fdget()/fdput() · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 11/28] introduce "fd_pos" class, convert fdget_pos() users to it. · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 13/28] privcmd_ioeventfd_assign(): don't open-code eventfd_ctx_fdget() · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 10/28] fdget_raw() users: switch to CLASS(fd_raw) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 15/28] fdget(), more trivial conversions · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 14/28] fdget(), trivial conversions · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
Re: [PATCH v3 14/28] fdget(), trivial conversions · Francesco Lavra <hidden> · 2024-11-11
[PATCH v3 17/28] convert cachestat(2) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 19/28] convert spu_run(2) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 20/28] convert media_request_get_by_fd() · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 22/28] convert vfs_dedupe_file_range(). · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 21/28] convert cifs_ioctl_copychunk() · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 18/28] switch spufs_calls_{get,put}() to CLASS() use · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 16/28] convert do_preadv()/do_pwritev() · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 24/28] do_pollfd(): convert to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 26/28] memcg_write_event_control(): switch to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 23/28] convert do_select() · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 28/28] deal with the last remaing boolean uses of fd_file() · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 27/28] css_set_fork(): switch to CLASS(fd_raw, ...) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 25/28] assorted variants of irqfd setup: convert to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 02/28] regularize emptiness checks in fini_module(2) and vfs_dedupe_file_range() · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 04/28] get rid of perf_fget_light(), convert kernel/events/core.c to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 03/28] timerfd: switch to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
[PATCH v3 06/28] do_mq_notify(): saner skb freeing on failures · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-02
Re: [PATCH v3 01/28] net/socket.c: switch to CLASS(fd) · Simon Horman <horms@kernel.org> · 2024-11-02
Re: [PATCH v3 01/28] net/socket.c: switch to CLASS(fd) · Al Viro <viro@zeniv.linux.org.uk> · 2024-11-03
Re: [PATCH v3 01/28] net/socket.c: switch to CLASS(fd) · Simon Horman <horms@kernel.org> · 2024-11-06

Re: [PATCH 01/39] memcg_write_event_control(): fix a user-triggerable oops

From: Al Viro <viro@zeniv.linux.org.uk>
Date: 2024-07-30 07:18:53
Also in: bpf, cgroups, kvm, linux-fsdevel

On Tue, Jul 30, 2024 at 09:13:38AM +0200, Michal Hocko wrote:

On Tue 30-07-24 01:15:47, viro@kernel.org wrote:

quoted

From: Al Viro <viro@zeniv.linux.org.uk>

we are *not* guaranteed that anything past the terminating NUL
is mapped (let alone initialized with anything sane).

[the sucker got moved in mainline]

You could have preserved
Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications")
Cc: stable

quoted

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

and
Acked-by: Michal Hocko <mhocko@suse.com>

Will do; FWIW, I think it would be better off going via the
cgroup tree - it's completely orthogonal to the rest of the
series, the only relation being "got caught during the same
audit"...

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help