Messages in this thread | | | Date | Wed, 28 Jan 2009 11:36:40 +0000 | From | Alan Cox <> | Subject | Re: [PATCH 1/3] epoll: increase default max_user_instances to 1024 |
| |
> > "A kernel upgrade in a -stable series point release fixed a security DoS" > > Alan, that's a complete load of bollocks. It broke common configurations > of java, postfix and apache on real-world machines, causing significant > actual denials of service in previously reliable configurations.
It fixed a security DoS. I was merely pointing out that the description provided before was bogus, incomplete and loaded.
> viable within the code. The DoS works by creating epoll descriptors > watching other epoll descriptors, which strikes me as a much less > real-world actual use pattern than a bunch of separate daemons with an > epoll watcher each.
Deliberate attackers don't have to follow typical usage patterns.
> If it's possible to count watches only if they're added to another epoll > instance, then we'd have a metric that still catches the N^2 attack, but > doesn't interact with the common non-attacky use-case.
Agreed entirely.
| |