lkml.org 
[lkml]   [2001]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: rw_semaphores
    On Mon, Apr 16, 2001 at 10:05:57AM -0700, Linus Torvalds wrote:
    >
    >
    > On Mon, 16 Apr 2001 yodaiken@fsmlabs.com wrote:
    > >
    > > I'm trying to imagine a case where 32,000 sharing a semaphore was anything but a
    > > major failure and I can't. To me: the result of an attempt by the 32,768th locker
    > > should be a kernel panic. Is there a reasonable scenario where this is wrong?
    >
    > Hint: "I'm trying to imagine a case when writing all zeroes to /etc/passwd
    > is anything but a major failure, but I can't. So why don't we make
    > /etc/passwd world-writable?"
    >
    > Right. Security.

    The analogy is too subtle for me,
    but my question was not whether the correct error
    response should be to panic, but whether there was a good reason for allowing
    such a huge number of users of a lock.

    > There is _never_ any excuse for panic'ing because of some inherent
    > limitation of the data structures. You can return -ENOMEM, -EAGAIN or
    > somehting like that, but you must _not_ allow a panic (or a roll-over,
    > which would just result in corrupted kernel data structures).

    There's a difference between a completely reasonable situation in which
    all of some resource has been committed
    and a situation which in itself indicates some sort of fundamental error.
    If 32K+ users of a lock is an errror, then returning -ENOMEM may be
    inadequate.

    >
    > Note that the limit is probably really easy to work around even without
    > extending the number of bits: a sleeper that notices that the count is
    > even _halfway_ to rolling around could easily do something like:
    >
    > - undo "this process" action
    > - sleep for 1 second
    > - try again from the beginning.
    >
    > I certainly agree that no _reasonable_ pattern can cause the failure, but
    > we need to worry about people who are malicious. The above trivial
    > approach would take care of that, while not penalizing any non-malicious
    > users.

    Ok. I'm too nice a guy to think about malicious users so I simply considered
    the kernel error case.
    You probably want a diagnostic so people who get mysterious slowdowns can
    report:
    /var/log/messages included the message "Too many users on lock 0x..."


    >
    > So I'm not worried about this at all. I just want people _always_ to think
    > about "how could I mis-use this if I was _truly_ evil", and making sure it
    > doesn't cause problems for others on the system.
    >
    > (NOTE: This does not mean that the kernel has to do anything _reasonable_
    > under all circumstances. There are cases where Linux has decided that
    > "this is not something a reasonable program can do, and if you try to do
    > it, we'll give you random results back - but they will not be _security_
    > holes". We don't need to be _nice_ to unreasonable requests. We just must
    > never panic, otherwise crash or allow unreasonable requests to mess up
    > _other_ people)
    >
    > Linus

    --
    ---------------------------------------------------------
    Victor Yodaiken
    Finite State Machine Labs: The RTLinux Company.
    www.fsmlabs.com www.rtlinux.com

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:25    [W:3.241 / U:0.488 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site