From: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
To: Marty McFadden <mcfadden8@llnl.gov>
Cc: ak@linux.intel.com, andriy.shevchenko@linux.intel.com,
bp@alien8.de, bp@suse.de, brgerst@gmail.com,
dan.j.williams@intel.com, dyoung@redhat.com, hpa@zytor.com,
linux@horizon.com, linux-kernel@vger.kernel.org, luto@kernel.org,
mingo@redhat.com, pavel@ucw.cz, tglx@linutronix.de,
viro@zeniv.linux.org.uk, x86@kernel.org, yu.c.chen@intel.com
Subject: Re: [PATCH 4/4] MSR: msr Batch processing feature
Date: Thu, 3 Mar 2016 17:21:01 +0000 [thread overview]
Message-ID: <20160303172101.7e288aef@lxorguk.ukuu.org.uk> (raw)
In-Reply-To: <1456444979-224547-5-git-send-email-mcfadden8@llnl.gov>
> + myinfo->rawio_allowed = capable(CAP_SYS_RAWIO);
> + file->private_data = myinfo;
That strikes me as a very bad idea btw. If your opener was privileged and
leaks the handle via exec or anything else to another process that
process inherits the powers which means it can own the system trivially.
(Texbook example was the early 4BSD socket bug where any root created
socket could be used to reconfigure networking which meant rsh could be
used to do wonderful things. Then faithfully duplicated in Solaris 2.x
*after* BSD fixed it ;) )
> +static long msrbatch_ioctl(struct file *f, unsigned int ioc, unsigned long arg)
> +{
> + int err = 0;
> + struct msr_batch_array __user *uoa;
> + struct msr_batch_op __user *uops;
> + struct msr_batch_array koa;
> + struct msrbatch_session_info *myinfo = f->private_data;
> +
> + if (ioc != X86_IOC_MSR_BATCH) {
> + pr_err("Invalid ioctl op %u\n", ioc);
So a user can fill your log because you have lots of pr_err() calls etc
> + err = msrbatch_apply_whitelist(&koa, myinfo);
Two threads doing this at once will break if they issue overlapping
requests with and/or (plus whatever carnage if you clash with any other
kernel used MSR)
Alan
next prev parent reply other threads:[~2016-03-03 17:21 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-26 0:02 [PATCH 0/4] MSR: MSR: MSR Whitelist and Batch Introduction Marty McFadden
2016-02-26 0:02 ` [PATCH 1/4] MSR: Prep for separating msr.c into three files Marty McFadden
2016-02-26 2:56 ` kbuild test robot
2016-02-26 10:08 ` Andy Shevchenko
2016-02-26 0:02 ` [PATCH 2/4] " Marty McFadden
2016-02-26 0:02 ` [PATCH 3/4] MSR: msr Whitelist Implementation Marty McFadden
2016-02-26 1:05 ` [PATCH] MSR: fix badzero.cocci warnings kbuild test robot
2016-02-26 1:05 ` [PATCH 3/4] MSR: msr Whitelist Implementation kbuild test robot
2016-02-26 0:02 ` [PATCH 4/4] MSR: msr Batch processing feature Marty McFadden
2016-02-26 2:48 ` Andy Lutomirski
2016-03-03 17:21 ` One Thousand Gnomes [this message]
2016-03-03 23:09 ` Mcfadden, Marty Jay
2016-02-26 7:37 ` [PATCH 0/4] MSR: MSR: MSR Whitelist and Batch Introduction Ingo Molnar
2016-02-28 18:54 ` Mcfadden, Marty Jay
2016-02-28 19:01 ` Borislav Petkov
2016-02-29 2:55 ` Mcfadden, Marty Jay
2016-02-29 14:58 ` Borislav Petkov
2016-02-29 16:31 ` Henrique de Moraes Holschuh
2016-02-29 17:22 ` Borislav Petkov
2016-02-29 17:53 ` George Spelvin
2016-02-29 18:20 ` Borislav Petkov
2016-02-29 22:35 ` Mcfadden, Marty Jay
2016-02-29 23:41 ` Borislav Petkov
2016-03-01 19:01 ` Rountree, Barry L.
2016-03-03 0:40 ` Andy Lutomirski
2016-03-01 8:02 ` Thomas Gleixner
2016-03-01 18:29 ` Rountree, Barry L.
2016-03-01 18:38 ` Borislav Petkov
2016-02-29 17:17 ` Andy Lutomirski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160303172101.7e288aef@lxorguk.ukuu.org.uk \
--to=gnomes@lxorguk.ukuu.org.uk \
--cc=ak@linux.intel.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=bp@alien8.de \
--cc=bp@suse.de \
--cc=brgerst@gmail.com \
--cc=dan.j.williams@intel.com \
--cc=dyoung@redhat.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@horizon.com \
--cc=luto@kernel.org \
--cc=mcfadden8@llnl.gov \
--cc=mingo@redhat.com \
--cc=pavel@ucw.cz \
--cc=tglx@linutronix.de \
--cc=viro@zeniv.linux.org.uk \
--cc=x86@kernel.org \
--cc=yu.c.chen@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®