linux-kernel - Re: [GIT PULL] kdbus for 4.1-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150416010402.GU889@ZenIV.linux.org.uk>
Date:	Thu, 16 Apr 2015 02:04:03 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Richard Weinberger <richard.weinberger@...il.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Arnd Bergmann <arnd@...db.de>, Tom Gundersen <teg@...m.no>,
	Jiri Kosina <jkosina@...e.cz>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Daniel Mack <daniel@...que.org>,
	David Herrmann <dh.herrmann@...il.com>,
	Djalal Harouni <tixxdz@...ndz.org>
Subject: Re: [GIT PULL] kdbus for 4.1-rc1

On Wed, Apr 15, 2015 at 05:47:18PM -0700, Andy Lutomirski wrote:

> I wonder if we could get away with having the receiver pre-allocate
> some placeholder fds and then have the kernel replace a placeholder
> with a passed fd immediately when the fd is sent and enqueue *that* in
> the cmsg data.  If you send an fd to someone who hasn't assigned any
> placeholders to the receiving socket, then you get an error.

*UGH*

It's a really bad idea.  The thing is, descriptor table that isn't shared
is assumed to be unchanged.  So when fdget() looks a file up, it doesn't
have to bump its refcount - the reference in descriptor table itself will
stay.  Conversely, fdput() doesn't have to drop it in such case (we encode
whether we need to drop into struct fd returned by fdget() and passed to
fdput()).

That relies on no third-party modifications of descriptor table and yes,
the effect _is_ noticable - playing with struct file refcounts does result
in considerable overhead.

If recepient sits in "gimme a descriptor", we are fine - if descriptor table
was shared, the other users would be doing full refcount song and dance and
if it wasn't, recepient is the sole user _and_ it isn't betwee fdget() and
fdput() at the moment.  With your "replace the dummies when sending" trick
we break all of that - we don't know what the recepient is doing at the moment
and for all we know they might be in the middle of something like e.g.
fstat() on your placeholder.  With rather unpleasant effects...
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/