linux-kernel - Re: Yet another pipe related oops.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 1 Apr 2013 18:55:16 -0700
From:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:	Al Viro <viro@...IV.linux.org.uk>
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Dave Jones <davej@...hat.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: Yet another pipe related oops.

On Tue, Apr 02, 2013 at 01:22:04AM +0100, Al Viro wrote:
> On Tue, Apr 02, 2013 at 12:27:18AM +0100, Al Viro wrote:
> > On Mon, Apr 01, 2013 at 02:44:36PM -0700, Greg Kroah-Hartman wrote:
> > > > > I guess you are right, it will not.  I guess we need to do what
> > > > > character devices do and have an "intermediate" fops in order to protect
> > > > > this.  Would that work?
> > > > 
> > > > You mean, with reassigning ->f_op in ->open()?  That'll work, as long as
> > > > we have exclusion between removal and fetching the sucker in primary
> > > > ->open()...  Where would you prefer to stash fops?
> > > 
> > > Ick, that's not going to work as the current api just uses a fops and
> > > debugfs doesn't keep anything else hanging around that referes to
> > > something "before" that, like 'struct cdev' does.
> > 
> > Er?  How about just sticking it into dentry->d_fsdata and letting
> > debugfs_remove() zero that out?  What am I missing here?

Nothing, you are right, that would work just fine.  Want me to fix it
up, or do you want to?

> Hrm...  For what it's worth, how do debugfs entries associated with
> dynamic objects deal with debugfs_remove() vs. method calls?  I don't
> see _anything_ in {,__}debugfs_remove() that would looks like "wait
> for ongoing write(2) attempts to complete".  IOW, forget rmmod - WTF
> protects us from access-after-free for any kind of data that isn't
> permanently allocated?

Nothing protects you from that, that's what I was trying to get at with
the dynamic attributes comment.

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/