lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+FuTSfA=_1VPFbUAh+5_+Xa_UxuTiFgGPGVRzfEtZLkvW6a9g@mail.gmail.com>
Date:	Thu, 20 Aug 2015 22:49:25 -0400
From:	Willem de Bruijn <willemb@...gle.com>
To:	David Miller <davem@...emloft.net>
Cc:	Network Development <netdev@...r.kernel.org>,
	"Michael S. Tsirkin" <mst@...hat.com>,
	Jason Wang <jasowang@...hat.com>
Subject: Re: [PATCH net-next RFC 00/10] socket sendmsg MSG_ZEROCOPY

On Thu, Aug 20, 2015 at 6:56 PM, David Miller <davem@...emloft.net> wrote:
> From: Willem de Bruijn <willemb@...gle.com>
> Date: Thu, 20 Aug 2015 10:36:39 -0400
>
>> Datapath integrity does not otherwise depend on payload, with three
>> exceptions: checksums, optional sk_filter/tc u32/.. and device +
>> driver logic. The effect of wrong checksums is limited to the
>> misbehaving process. Filters may have to be addressed by inserting a
>> preventative skb_copy_ubufs(). Device drivers can be whitelisted,
>> similar to scatter-gather support (NETIF_F_SG).
>
> Consider a userland NFS implementation sending over loopback while
> constantly modifying the page.  The sunrpc code could be tricked into
> seeing one thing during validation of the RPC headers then doing
> another after the user makes changes.
>
> I really don't think this is completely safe as-is.

Sunrpc is a great counter example. Anything that calls
kernel_recvmsg may be problematic, I guess. Copying when
passing to kernel sockets would plug that class of issues.

But there may still be others. Most obvious use case for copy
avoidance is pure device transmit. Excluding loopback may be
a reasonable way to initially limit the attack surface. With a flag
NETIF_F_ZC not supported on lo.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ