linux-kernel - Re: [GIT PULL] kdbus for 4.1-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 15 Apr 2015 22:53:44 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Al Viro <viro@...iv.linux.org.uk>
Cc:	Arnd Bergmann <arnd@...db.de>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Jiri Kosina <jkosina@...e.cz>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Daniel Mack <daniel@...que.org>,
	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Tom Gundersen <teg@...m.no>,
	Richard Weinberger <richard.weinberger@...il.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	David Herrmann <dh.herrmann@...il.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Djalal Harouni <tixxdz@...ndz.org>
Subject: Re: [GIT PULL] kdbus for 4.1-rc1

On Apr 15, 2015 6:04 PM, "Al Viro" <viro@...iv.linux.org.uk> wrote:
>
> On Wed, Apr 15, 2015 at 05:47:18PM -0700, Andy Lutomirski wrote:
>
> > I wonder if we could get away with having the receiver pre-allocate
> > some placeholder fds and then have the kernel replace a placeholder
> > with a passed fd immediately when the fd is sent and enqueue *that* in
> > the cmsg data.  If you send an fd to someone who hasn't assigned any
> > placeholders to the receiving socket, then you get an error.
>
> *UGH*
>
> It's a really bad idea.  The thing is, descriptor table that isn't shared
> is assumed to be unchanged.  So when fdget() looks a file up, it doesn't
> have to bump its refcount - the reference in descriptor table itself will
> stay.  Conversely, fdput() doesn't have to drop it in such case (we encode
> whether we need to drop into struct fd returned by fdget() and passed to
> fdput()).
>
> That relies on no third-party modifications of descriptor table and yes,
> the effect _is_ noticable - playing with struct file refcounts does result
> in considerable overhead.
>
> If recepient sits in "gimme a descriptor", we are fine - if descriptor table
> was shared, the other users would be doing full refcount song and dance and
> if it wasn't, recepient is the sole user _and_ it isn't betwee fdget() and
> fdput() at the moment.  With your "replace the dummies when sending" trick
> we break all of that - we don't know what the recepient is doing at the moment
> and for all we know they might be in the middle of something like e.g.
> fstat() on your placeholder.  With rather unpleasant effects...

Hmm.

I don't love the special blocking call either -- it break polling loops.

We could have the existence of a placeholderfd count as an extra
reference to the descriptor table, with the associated performance
hit.  Or we could allow each placeholderfd to collect one received fd
but not actually switch over.  The latter is ugly and still has minor
DoS issues -- we'd have to prevent placeholderfds from being passed
through this mechanism or SCM_RIGHTS.

But wait... what about an evil trick?  What if all placeholderfds are
the *same* struct file and that struct file is never deleted?  Then
fdget on a placeholderfd is safe, since it's implicitly pinned.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/