Re: [PATCH v2] netfilter: xt_owner: Add supplementary groups option

[Lukasz Pawelczyk]

On Thu, 2019-05-09 at 04:57 -0700, Eric Dumazet wrote:
> sk_socket keeps reference to f_cred. f_cred keeps reference to
> > group_info. As long as f_cred is alive and it doesn't seem to be
> > the
> > issue in the owner_mt() function, group_info should be alive as
> > well as
> > far as I can see. Its refcount will go down only when f_cred is
> > freed
> > (put_cred_rcu()).
> > 
> > If there is something I'm missing please correct me.
> 
> The problem is that you canÂt clearly explain why the code is safe :/
> 
> Why would get_group_info() be needed then ?

Originally I though it wouldn't, that's why I did not include it in the
patch. Your question made me doubt that for a second. I also got
confused a little because the group_info code looked completely
different a while back, it got reworked and simplified.

> 
> You need to explain this in the changelog, so that future bug hunters
> do not have
> to guess.

Ok, I will.

-- 
Lukasz Pawelczyk
Samsung R&D Institute Poland
Samsung Electronics