From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761758AbYDNTD0 (ORCPT ); Mon, 14 Apr 2008 15:03:26 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755543AbYDNTDM (ORCPT ); Mon, 14 Apr 2008 15:03:12 -0400 Received: from styx.suse.cz ([82.119.242.94]:37985 "EHLO mail.suse.cz" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753464AbYDNTDK (ORCPT ); Mon, 14 Apr 2008 15:03:10 -0400 Date: Mon, 14 Apr 2008 21:03:09 +0200 From: Jan Kara To: Lennart Sorensen Cc: Bodo Eggert <7eggert@gmx.de>, Diego Calleja , Jiri Kosina , Michal Hocko , Meelis Roos , Linux Kernel list , linux-fsdevel@vger.kernel.org Subject: Re: file offset corruption on 32-bit machines? Message-ID: <20080414190308.GJ15824@duck.suse.cz> References: <20080411135544.GG2160@csclub.uwaterloo.ca> <20080414162031.GD15824@duck.suse.cz> <20080414162202.GB7387@csclub.uwaterloo.ca> <20080414165354.GF15824@duck.suse.cz> <20080414170613.GI7385@csclub.uwaterloo.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20080414170613.GI7385@csclub.uwaterloo.ca> User-Agent: Mutt/1.5.16 (2007-06-09) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon 14-04-08 13:06:13, Lennart Sorensen wrote: > On Mon, Apr 14, 2008 at 06:53:54PM +0200, Jan Kara wrote: > > Well, but imagine you have a file /proc/my_secret_file from which you > > are able to read from position A:a and B:b but not from position > > A:b. Concievably, checks for the file position could be bypassed because of > > this race... I know this is kind of dumb example but I can imagine someone > > can eventually find something like this. So I guess one spin lock/unlock > > pair is a price worth paying in the callpath which is quite long anyway. > > But only two threads within the process can read from the filehandle and > hence the process would be doing locking. And external attacker can't Why would it be doing locking? If some nasty user runs the process, he *wants* his two threads to race as much as possible and trigger the race. And then use corrupted f_pos. > break the internal locking of the process between the threads, and even > if you do open the file in /proc that the process is using, being and > external process you would have your own file handle and hence your own > file position since you aren't part of that process. Honza -- Jan Kara SUSE Labs, CR