Re: [Security] DoS on x86_64

["H. Peter Anvin" <hpa@zytor.com>]

On 01/28/2010 03:06 PM, Linus Torvalds wrote:
> 
> 
> On Thu, 28 Jan 2010, Linus Torvalds wrote:
>>
>> I have _not_ tested any of this, and maybe there is some crazy reason why 
>> this won't work, but I'm not seeing it.
> 
> Grr. We also do "arch_pick_mmap_layout()" in "flush_old_exec()".
> 
> That whole function is mis-named. It doesn't actually flush the old exec, 
> it also creates the new one.
> 
> However, we then re-do it afterwards in fs/binfmt_elf.c, so again, that 
> doesn't really matter.
> 
> What _does_ matter, however, is the crazy stuff we do in flush_thread() 
> wrt TIF_ABI_PENDING. That's just crazy.
> 
> So no, the trivial patch won't work.
> 
> How about splitting up "flush_old_exec()" into two pieces? We'd have a 
> "flush_old_exec()" and a "setup_new_exec()" piece, and all existing 
> callers of flush_old_exec() would just be changed to call both?
> 

Ah yes.  This really is a lot better than the track which I originally
was thinking about, which was something like adding a callout from
flush_old_exec().

I will try this... plus remove the TIF_ABI_PENDING stuff from x86, and
see how it works.

	-hpa

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>