All of lore.kernel.org
 help / color / mirror / Atom feed
* [Virtio-fs] [PATCH v2 0/2] virtiofsd: stay under fs.file-max sysctl limit (CVE-2020-10717)
@ 2020-05-01 14:06 ` Stefan Hajnoczi
  0 siblings, 0 replies; 8+ messages in thread
From: Stefan Hajnoczi @ 2020-05-01 14:06 UTC (permalink / raw)
  To: qemu-devel; +Cc: virtio-fs, vgoyal, pjp

This patch series introduces the --rlimit-nofile=NUM option for setting the
number of open files on the virtiofsd process.  This gives users and management
tools more control over resource limits.

Previously it was possible for FUSE clients on machines with less than ~10 GB
of RAM to exhaust the system-wide open file limit.  This is a denial of service
attack against other processes running on the host.

This patch series updates the default RLIMIT_NOFILE calculation to take the
fs.file-max sysctl value into account.  This solves the fs.file-max DoS.

Stefan Hajnoczi (2):
  virtiofsd: add --rlimit-nofile=NUM option
  virtiofsd: stay below fs.file-max sysctl value (CVE-2020-10717)

 tools/virtiofsd/fuse_lowlevel.h  |  1 +
 tools/virtiofsd/helper.c         | 47 ++++++++++++++++++++++++++++++++
 tools/virtiofsd/passthrough_ll.c | 22 ++++++---------
 3 files changed, 56 insertions(+), 14 deletions(-)

-- 
2.25.3



^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2020-05-01 17:43 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-05-01 14:06 [Virtio-fs] [PATCH v2 0/2] virtiofsd: stay under fs.file-max sysctl limit (CVE-2020-10717) Stefan Hajnoczi
2020-05-01 14:06 ` Stefan Hajnoczi
2020-05-01 14:06 ` [Virtio-fs] [PATCH v2 1/2] virtiofsd: add --rlimit-nofile=NUM option Stefan Hajnoczi
2020-05-01 14:06   ` Stefan Hajnoczi
2020-05-01 14:06 ` [Virtio-fs] [PATCH v2 2/2] virtiofsd: stay below fs.file-max sysctl value (CVE-2020-10717) Stefan Hajnoczi
2020-05-01 14:06   ` Stefan Hajnoczi
2020-05-01 17:42 ` [Virtio-fs] [PATCH v2 0/2] virtiofsd: stay under fs.file-max sysctl limit (CVE-2020-10717) Dr. David Alan Gilbert
2020-05-01 17:42   ` Dr. David Alan Gilbert

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.