netdev - Re: rhashtable issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bdnyshk47krppnfczkn3tgdfslylof3pxhxu7nt2xq4oawyio4@ktfab5bu7lis>
Date: Mon, 25 Nov 2024 23:35:48 -0500
From: Kent Overstreet <kent.overstreet@...ux.dev>
To: Herbert Xu <herbert@...dor.apana.org.au>
Cc: NeilBrown <neilb@...e.de>, Thomas Graf <tgraf@...g.ch>, 
	netdev@...r.kernel.org
Subject: Re: rhashtable issue - -EBUSY

On Tue, Nov 26, 2024 at 12:00:01PM +0800, Herbert Xu wrote:
> On Mon, Nov 25, 2024 at 10:51:04PM -0500, Kent Overstreet wrote:
> >
> > I just meant having a knob that's called "insecure". Why not a knob
> > that selects nonblocking vs. reliable?
> 
> Because it is *insecure*.  If a hostile actor gains the ability
> to insert into your hash table, then by disabling this defence
> you're giving them the ability to turn your hash table into a
> linked list.
> 
> So as long as you acknowledge and are willing to undertake this
> risk, I'm happy for you to do that.  But I'm not going to hide
> this under the rug.

That knob was. That's not what I'm suggesting. Can you go back and
re-read my, and Neal's, suggestion?