| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1334566193.28012.66.camel@edumazet-glaptop> Date: Mon, 16 Apr 2012 10:49:53 +0200 From: Eric Dumazet <eric.dumazet@...il.com> To: "Michael S. Tsirkin" <mst@...hat.com> Cc: Jason Wang <jasowang@...hat.com>, netdev@...r.kernel.org, xma@...ibm.com, davem@...emloft.net, linux-kernel@...r.kernel.org, ebiederm@...ssion.com Subject: Re: [PATCH 2/6] macvtap: zerocopy: fix truesize underestimation On Mon, 2012-04-16 at 10:14 +0300, Michael S. Tsirkin wrote: > On Mon, Apr 16, 2012 at 02:07:59PM +0800, Jason Wang wrote: > > As the skb fragment were pinned/built from user pages, we should > > account the page instead of length for truesize. > > > > Signed-off-by: Jason Wang <jasowang@...hat.com> > > I'm not sure this is right: the skb does *not* consume the > whole page, userspace uses the rest of the page > for other skbs. So we'll end up accounting for the > same page twice. > Eric, what's the right thing to do here in your opinion? Problem is we dont know for sure userspace wont free pages right after this syscall. So an evil application could consume more kernel memory than what socket limit allowed. Its same problem with vmsplice(mem -> pipe) + splice(pipe -> socket) When we clone skb with frags, resulting skb will have same truesize, even if the pages are shared ... -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists