lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <AANLkTiksRN1DweFkwzhaTe7fUayKEDrjHzn7xSScikV7@mail.gmail.com> Date: Sat, 4 Sep 2010 13:52:13 +0200 From: Michał Mirosław <mirqus@...il.com> To: Eric Dumazet <eric.dumazet@...il.com>, Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>, netdev@...r.kernel.org Subject: Re: [PATCH] UNIX: Do not loop forever at unix_autobind(). 2010/9/4 Eric Dumazet <eric.dumazet@...il.com>: > Le samedi 04 septembre 2010 à 15:58 +0900, Tetsuo Handa a écrit : >> From a67ccbb8033993df29f26bde9944e37bffe4fc1b Mon Sep 17 00:00:00 2001 >> From: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp> >> Date: Sat, 4 Sep 2010 15:22:22 +0900 >> Subject: [PATCH] UNIX: Do not loop forever at unix_autobind(). >> >> We assumed that unix_autobind() never fails if kzalloc() succeeded. >> But unix_autobind() allows only 1048576 names. If /proc/sys/fs/file-max is >> larger than 1048576 (e.g. systems with more than 10GB of RAM), a local user can >> consume all names using fork()/socket()/bind(). >> >> If all names are in use, those who call bind() with addr_len == sizeof(short) >> or connect()/sendmsg() with setsockopt(SO_PASSCRED) will continue >> >> while (1) >> yield(); >> >> loop at unix_autobind() till a name becomes available. >> This patch changes unix_autobind() to fail if all names are in use. >> >> Note that currently a local user can consume 2GB of kernel memory if the user >> is allowed to create and autobind 1048576 UNIX domain sockets. We should >> consider adding some restriction for autobind operation. [cut patch] > Sorry, this wont work very well if you have many processes using > autobind(). Some of them will loop many time before hitting > "stop_ordernum". > > unsigned int counter; > > ... > > if (++maxtries == 1<<20) { > ... > } > > > This is a pathological situation. We are not forced to give a successful > autobind() when so many sockets are in use, even if some slots are > available. Is there any specific requirement on generated names for auto-bind? Wouldn't it be easier and more efficient to use some pseudo-random name. i.e. derived from current time and/or owning process state? Best Regards, Michał Mirosław -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists