[lkml]   [2008]   [Apr]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: file offset corruption on 32-bit machines?
    > On Thu, 10 Apr 2008, Jan Kara wrote:
    > > > The f_pos races are in fact exploitable, we've already been there. See
    > > > for example
    > > Well, this race is more subtle - the window is just one instruction
    > > wide (stores to f_pos from CPU2 must come between the store of lower and
    > > upper 32-bits of f_pos on CPU1). And the only result is that f_pos has
    > > 32-bits from one file pointer and 32-bits from the other one. So I can
    > > hardly imagine this would be exploitable...
    > Supposing you are not holding any spinlock and are running with
    > preemptible kernel (pretty common scenario nowadays), there is nothing
    > that would prevent kernel from rescheduling between the two instructions,
    > enlarging the race window to be more comfortable for attacker, right?
    Yes, this is theoretically possible.

    > I think this is worth fixing.
    Hmm, maybe it is, although I still don't see how to exploit it :).

    Jan Kara <>
    SuSE CR Labs

     \ /
      Last update: 2008-04-10 17:23    [W:0.025 / U:3.244 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site