linux-kernel - Re: [musl] getdents64 lost direntries with SMB/NFS and buffer size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20191226035606.GB10794@mit.edu>
Date:   Wed, 25 Dec 2019 22:56:06 -0500
From:   "Theodore Y. Ts'o" <tytso@....edu>
To:     Florian Weimer <fw@...eb.enyo.de>
Cc:     Rich Felker <dalias@...c.org>, linux-fsdevel@...r.kernel.org,
        musl@...ts.openwall.com, linux-kernel@...r.kernel.org,
        linux-nfs@...r.kernel.org, linux-cifs@...r.kernel.org
Subject: Re: [musl] getdents64 lost direntries with SMB/NFS and buffer size <
 unknown threshold

On Wed, Dec 25, 2019 at 08:38:07PM +0100, Florian Weimer wrote:
> 32 bits are simply not enough storage space for the cookie.  Hashing
> just masks the presence of these bugs, but does not eliminate them
> completely.

Arguably 64 bits is not enough space for the cookie.  I'd be a lot
happier if it was 128 or 256 bits.  This is just one of those places
where POSIX is Really Broken(tm).  Unfortunately, NFS only gives us 64
bits for the readdir/readdirplus cookie, so we're kind of stuck with
it.

					- Ted