[2/2] fs: reject unknown open flags
Commit Message
This way userspace can probe for actually supported flags.
Signed-off-by: Christoph Hellwig <hch@lst.de>
---
fs/open.c | 3 +++
1 file changed, 3 insertions(+)
Comments
On Thu, Mar 30, 2017 at 9:33 AM, Christoph Hellwig <hch@lst.de> wrote:
> This way userspace can probe for actually supported flags.
No. Not this way.
First off, since we've never checked the flags, it really is likely
that somebody just by mistake passes in garbage.
So it might cause a regression, which means we might need to revert
it, which in turn means that we sure as hell do *not* want to
encourage _other_ people to then use this to "probe" the accepted
flags.
Secondly, since we know old kernels don't test the flags, it is
*doubly* stupid to then talk about "probing accepted flags".
So the whole concept of probing is pure and utter f*cking garbage.
So get that idiotic idea out of your head.
What might be acceptable is to say "we should have not accepted random
flags to begin with", and add this error case, but realize that
probing for those flags is completely idiotic and moronic.
Once you do that, you can then say "to make it easier to see if
somebody might have passed in garbage that just happened to work, we
can add a WARN_ON_ONCE()" for this case. That has the added advantage
that it hopefully makes people understand just how stipid that idiotic
"probe flags" idea was.
Anyway, big NAK on this idiotic patch series, since as is the whole
concept and reasoning for it is crazy crap.
People, you need to really understand and INTERNALIZE that backwards
compatibility is important.
You need to understand it so well that you go "wow, this whole idea
about probing was obviously shit".
Really.
Linus
@@ -900,6 +900,9 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
int lookup_flags = 0;
int acc_mode = ACC_MODE(flags);
+ if (flags & ~VALID_OPEN_FLAGS)
+ return -EINVAL;
+
if (flags & (O_CREAT | __O_TMPFILE))
op->mode = (mode & S_IALLUGO) | S_IFREG;
else