lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 23 May 2014 10:49:14 +0200
From:	Peter Zijlstra <>
To:	Kees Cook <>
	Andy Lutomirski <>,
	Oleg Nesterov <>,
	Alexander Viro <>,
	James Morris <>,
	Eric Paris <>,
	Juri Lelli <>,
	John Stultz <>,
	"David S. Miller" <>,
	Daniel Borkmann <>,
	Alex Thorlton <>,
	Rik van Riel <>,
	Daeseok Youn <>,
	David Rientjes <>,
	"Eric W. Biederman" <>,
	Dario Faggioli <>,
	Rashika Kheria <>,
	liguang <>,
	Geert Uytterhoeven <>,,
Subject: Re: [PATCH v5 3/6] seccomp: introduce writer locking

On Thu, May 22, 2014 at 04:05:33PM -0700, Kees Cook wrote:
> Normally, task_struct.seccomp.filter is only ever read or modified by
> the task that owns it (current). This property aids in fast access
> during system call filtering as read access is lockless.
> Updating the pointer from another task, however, opens up race
> conditions. To allow cross-task filter pointer updates, writes to the
> seccomp fields are now protected by a spinlock.  Read access remains
> lockless because pointer updates themselves are atomic.  However, writes
> (or cloning) often entail additional checking (like maximum instruction
> counts) which require locking to perform safely.
> In the case of cloning threads, the child is invisible to the system
> until it enters the task list. To make sure a child can't be cloned
> from a thread and left in a prior state, seccomp duplication is moved
> under the tasklist_lock. Then parent and child are certain have the same
> seccomp state when they exit the lock.

So I'm a complete noob on the whole seccomp thing, so maybe this is a
silly question, but.. what about object lifetimes?

Looking at put_seccomp_filter() it explicitly takes a tsk pointer,
suggesting one can call it on !current. And while it does a dec_and_test
on the object itself, run_filter() does nothing with refcounts, and
therefore can be touching dead memory.

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists