lkml.org 
[lkml]   [2012]   [Feb]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [kernel-hardening] Re: Add overflow protection to kref
    On Fri, Feb 24, 2012 at 10:37 -0800, Greg KH wrote:
    > On Fri, Feb 24, 2012 at 12:58:35PM -0500, David Windsor wrote:
    > > static inline void kref_get(struct kref *kref)
    > > {
    > > + int rc = 0;
    > > WARN_ON(!atomic_read(&kref->refcount));
    > > - atomic_inc(&kref->refcount);
    > > + smp_mb__before_atomic_inc();
    > > + rc = atomic_add_unless(&kref->refcount, 1, INT_MAX);
    > > + smp_mb__after_atomic_inc();
    > > + BUG_ON(!rc);
    >
    > So you are guaranteeing to crash a machine here if this fails? And you
    > were trying to say this is a "security" based fix?
    >
    > And people wonder why I no longer have any hair...

    If a refcounter overflows there is NO WAY to recover. The choise is to BUG()
    and not allow any security harm to the system (privilege escalation, etc.)
    or to try to do some more CPU cycles until actual use after free, privilege
    escalation, etc. The former is a _guarantee_ that nothing bad (in security
    sense) doesn't happen. The latter is an opportunistic approach, which
    doesn't work with security.

    Do you claim that a refcounter overflow is a recoverable state? I'd want to
    know what you can do with it.

    --
    Vasiliy Kulikov
    http://www.openwall.com - bringing security into open computing environments


    \
     
     \ /
      Last update: 2012-02-24 20:05    [W:0.021 / U:60.164 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site