linux-kernel - Re: [PATCH v3] vfs: new O

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091205231304.03a4af61@lxorguk.ukuu.org.uk>
Date:	Sat, 5 Dec 2009 23:13:04 +0000
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Miklos Szeredi <miklos@...redi.hu>
Cc:	miklos@...redi.hu, luto@....edu, akpm@...ux-foundation.org,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] vfs: new O_NODE open flag

On Sat, 05 Dec 2009 21:35:55 +0100
Miklos Szeredi <miklos@...redi.hu> wrote:

> On Sat, 5 Dec 2009, Alan Cox wrote:
> > I am concerned primarily about the lack of ability to get rid of such a
> > handle in a controlled fashion. The udev/device unload case is simply one
> > obvious way to exploit it.
> 
> I don't understand your concern.  Can you please ellaborate on the way
> to exploit O_NODE?

You end up with a handle to an object which then changes meaning if a
device is unloaded and something else loaded (or consider a pty
recreation)

In the normal udev course of things this is ok because even without
revoke udev can just about get away with it for the sole reason it knows
that the handle cannot be open in any form during the driver unload
(because of the device refcounting). You seem to break that.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/