lkml.org 
[lkml]   [2008]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: file offset corruption on 32-bit machines?
    On Mon 14-04-08 13:06:13, Lennart Sorensen wrote:
    > On Mon, Apr 14, 2008 at 06:53:54PM +0200, Jan Kara wrote:
    > > Well, but imagine you have a file /proc/my_secret_file from which you
    > > are able to read from position A:a and B:b but not from position
    > > A:b. Concievably, checks for the file position could be bypassed because of
    > > this race... I know this is kind of dumb example but I can imagine someone
    > > can eventually find something like this. So I guess one spin lock/unlock
    > > pair is a price worth paying in the callpath which is quite long anyway.
    >
    > But only two threads within the process can read from the filehandle and
    > hence the process would be doing locking. And external attacker can't
    Why would it be doing locking? If some nasty user runs the process, he
    *wants* his two threads to race as much as possible and trigger the race.
    And then use corrupted f_pos.

    > break the internal locking of the process between the threads, and even
    > if you do open the file in /proc that the process is using, being and
    > external process you would have your own file handle and hence your own
    > file position since you aren't part of that process.

    Honza
    --
    Jan Kara <jack@suse.cz>
    SUSE Labs, CR


    \
     
     \ /
      Last update: 2008-04-14 21:05    [W:2.700 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site