linux-kernel - Re: futex question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 5 Oct 2009 14:24:36 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Peter Zijlstra <peterz@...radead.org>,
	Oleg Nesterov <oleg@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	Anirban Sinha <ani@...rban.org>, linux-kernel@...r.kernel.org,
	Darren Hart <dvhltc@...ibm.com>,
	Kaz Kylheku <kaz@...gmasystems.com>,
	Anirban Sinha <asinha@...gmasystems.com>
Subject: Re: futex question

* Peter Zijlstra <peterz@...radead.org> wrote:

> On Mon, 2009-10-05 at 13:59 +0200, Thomas Gleixner wrote:
>
> > Stared at the same place a minute ago :) But still I wonder if it's 
> > a good idea to silently release locks and set the state to OWNERDEAD 
> > instead of hitting the app programmer with a big clue stick in case 
> > the app holds locks when calling execve().
> 
> Agreed, I rather like the feedback. With regular exit like things 
> there's just not much we can do to avoid the mess, but here we can 
> actually avoid it, seems a waste not to do so.

Well, exec() has been a 'exit() + boot-strap next process' kind of thing 
from the get go - with little state carried over into the new task. This 
has security and robustness reasons as well.

So i think exec() should release all existing state, unless told 
otherwise. Making it behave differently for robust futexes sounds 
assymetric to me.

It might make sense though - a 'prevent exec because you are holding 
locks!' thing. Dunno.

Cc:-ed a few execve() semantics experts who might want to chime in.

If a (buggy) app calls execve() with a (robust) futex still held should 
we auto-force-release robust locks held, or fail the exec with an error 
code? I think the forced release is a 'anomalous exit' thing mostly, 
while calling exec() is not anomalous at all.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/