Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1584789

Re: [PATCH 0/5] block subsystem refcounter conversions

Show all headers | View raw

On Mon, 2017-02-20 at 17:56 +0100, Peter Zijlstra wrote:
> On Mon, Feb 20, 2017 at 07:41:01AM -0800, James Bottomley wrote:
> > On Mon, 2017-02-20 at 08:15 -0700, Jens Axboe wrote:
> > > On 02/20/2017 04:16 AM, Elena Reshetova wrote:
> > > > Now when new refcount_t type and API are finally merged
> > > > (see include/linux/refcount.h), the following
> > > > patches convert various refcounters in the block susystem from 
> > > > atomic_t to refcount_t. By doing this we prevent intentional or
> > > > accidental underflows or overflows that can led to use-after
> > > > -free vulnerabilities.
> > 
> > This description isn't right ... nothing is prevented; we get 
> > warnings on saturation and use after free with this.
> 
> The thing that is prevented is overflow and then a use-after-free by
> making it a leak.
> 
> Modular stuff, you put and free at: (n+1) mod n, by saturating at n-1
> we'll never get there.
> 
> So you loose use-after-free, you gain a resource leak. The general 
> idea being that use-after-free is a nice trampoline for exploits, 
> leaks are 'only' a DoS.

OK, I see the intention: it's protection from outside influence.  It
still doesn't prevent *us* from screwing up in the kernel and inducing
a use after free by doing too many puts (or too few gets) ... that's
what the message suggests to me (me coding wrongly is accidental
underflows or overflows as I read it).

James

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH 0/5] block subsystem refcounter conversions Elena Reshetova <elena.reshetova@intel.com> - 2017-02-20 12:30 +0100
  [PATCH 4/5] block: convert io_context.active_ref from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-02-20 12:30 +0100
  [PATCH 3/5] block: convert blkcg_gq.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-02-20 12:30 +0100
  [PATCH 1/5] block: convert bio.__bi_cnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-02-20 12:30 +0100
  [PATCH 2/5] block: convert blk_queue_tag.refcnt from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-02-20 12:30 +0100
  [PATCH 5/5] block: convert bsg_device.ref_count from atomic_t to refcount_t Elena Reshetova <elena.reshetova@intel.com> - 2017-02-20 12:30 +0100
  Re: [PATCH 0/5] block subsystem refcounter conversions Jens Axboe <axboe@kernel.dk> - 2017-02-20 16:20 +0100
    Re: [PATCH 0/5] block subsystem refcounter conversions James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-02-20 16:50 +0100
      Re: [PATCH 0/5] block subsystem refcounter conversions Jens Axboe <axboe@kernel.dk> - 2017-02-20 17:00 +0100
      Re: [PATCH 0/5] block subsystem refcounter conversions Peter Zijlstra <peterz@infradead.org> - 2017-02-20 18:00 +0100
        Re: [PATCH 0/5] block subsystem refcounter conversions James Bottomley <James.Bottomley@HansenPartnership.com> - 2017-02-20 18:30 +0100

csiph-web