linux-kernel - Re: epoll design problems with common fork/exec patterns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0710271055160.12127@alien.or.mcafeemobile.com>
Date:	Sat, 27 Oct 2007 11:01:04 -0700 (PDT)
From:	Davide Libenzi <davidel@...ilserver.org>
To:	Willy Tarreau <w@....eu>
cc:	Marc Lehmann <linux-kernel@....eu>,
	Eric Dumazet <dada1@...mosbay.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: epoll design problems with common fork/exec patterns

On Sat, 27 Oct 2007, Willy Tarreau wrote:

> On Sat, Oct 27, 2007 at 09:59:07AM -0700, Davide Libenzi wrote:
> > On Sat, 27 Oct 2007, Marc Lehmann wrote:
> > 
> > > > Please provide some code to illustrate one exact problem you have.
> > > 
> > >    // assume there is an open epoll set that listens for events on fd 5
> > >    if (fork () = 0)
> > >      {
> > >        close (5);
> > >        // fd 5 is now removed from the epoll set of the parent.
> > >        _exit (0);
> > >      }
> > 
> > Hmmm ... what? I assume you know that:
> > 
> > 1) A file descriptor is a userspace view/handle of a kernel object
> > 
> > 2) The kernel object has a use-count for as many file descriptors that 
> >    have been handed out to userspace
> > 
> > 3) A close() decreases the internal counter by one
> > 
> > 4) The kernel object gets effectively closed when the internal counter 
> >    goes to zero
> > 
> > 5) A fork() acts as a dup() on the file descriptors by hence bumping up 
> >    its internal counter
> > 
> > 6) Epoll removes the file from the set, when the *kernel* object gets 
> >    closed (internal use-count goes to zero)
> > 
> > With that in mind, how can the code snippet above trigger a removal from 
> > the epoll set?
> 
> Davide,
> 
> from what I understand, Marc is not asking for the code above to remove
> the fd from the epoll set, but he's in fact complaining that he *observed*
> that the fd was removed from the epoll set in the *parent* process when
> the child closes it, which is of course not expected at all. As strange
> as it looks like, this might need investigation. It is possible that there
> is some strange bug somewhere in some kernel versions.

That would be *really* strange, since epoll hooks in __fput() in order to 
perform proper cleanup. This means that, in the case above, the file will 
be really closed in the parent too. That, I think, would trigger way more 
serious problems in userspace.



> Marc, I think that if you indicate the last kernel version on which you
> observed this and provide a very short and easy reproducer, it would
> help everyone investigating this. Basically something which reports "OK"
> or "KO".

Of course. That'd be great.



- Davide


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/