From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BBFEFC4361B for ; Tue, 8 Dec 2020 14:44:45 +0000 (UTC) Received: from shelob.surriel.com (shelob.surriel.com [96.67.55.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 9C33D23A5B for ; Tue, 8 Dec 2020 14:44:44 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9C33D23A5B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=vt.edu Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernelnewbies-bounces@kernelnewbies.org Received: from localhost ([::1] helo=shelob.surriel.com) by shelob.surriel.com with esmtp (Exim 4.94) (envelope-from ) id 1kmeDo-0004d5-JS; Tue, 08 Dec 2020 09:44:08 -0500 Received: from mail-qv1-xf41.google.com ([2607:f8b0:4864:20::f41]) by shelob.surriel.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94) (envelope-from ) id 1kmeDl-0004ch-DF for kernelnewbies@kernelnewbies.org; Tue, 08 Dec 2020 09:44:05 -0500 Received: by mail-qv1-xf41.google.com with SMTP id a13so3211332qvv.0 for ; Tue, 08 Dec 2020 06:44:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vt-edu.20150623.gappssmtp.com; s=20150623; h=sender:from:to:cc:subject:in-reply-to:references:mime-version :content-transfer-encoding:date:message-id; bh=vzeviVcuYVhareUvwuks7S1O7W3QXpW2Ird4KhOpy6g=; b=1e1qtY8XHSYvTZc320Nx99B9MWvyeZW3O46d4+vCw2fenVFX+Pwdew0vc6PIQ/p7iA rZZ/kHunVN2H64vbNGtwc+pxaEqcuk3RNq/Sswq3FfMzuhkSo3oqZJWYpXSHctYtC+MO UnSGyOKFpXzaqrAXzi78ytP1DxPQOuxgnTBO9ticfLwiw9TAi9XnrMnDoEaCcSv6z962 1yBnShqNqo+5hbcUwdkJpj//taUn/ug0BZMCzGhDbR9iiWzhbh0ERocLF0eLrk99UucE 3Xh7bk/mjethZBEyxZWUBf8PtO+f257pOrTYdYxDdsuYD4saHiHCvZM8dxecj47i913S 5NNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:in-reply-to:references :mime-version:content-transfer-encoding:date:message-id; bh=vzeviVcuYVhareUvwuks7S1O7W3QXpW2Ird4KhOpy6g=; b=my7yxD1aducqf3KlXmwxjora6W0GwT5d6m2uPw+n/4Rm7kY0Ej0KcT70FfnTM22cHl sYVi3+6Oa4fKhIWHjiWhfrpYqjkfAvbKDKf1AxNsCtEBzUDn5dzgD9ZaXrwCK+pvlMCN 1ZibnvmA6QSUpH+jBTQdx8RduZsezMf8ghiSekHiHbW8VG1vjvzZ98GEzs1pDxoiXw+8 K7S90+6SKaMHe2kmScT8rSjdVi/p5PCYinKXufUSLCmr+0t5ICPYMojpCxumevOFCUXh Pi73YVMxFZsj3Yf6jz2os3gga4905iv9IJ2JRonUAVaBEPpLbs/ci72MRUmE3WLQwht0 vAcg== X-Gm-Message-State: AOAM5335+aFphG5roZnz7wAgM9CUdDD38Ildpxte3J90zVH06HD5v1tw Oz9ixEdFCdmznYKEG5BM/JckJZiGp59fog== X-Google-Smtp-Source: ABdhPJyzbBxRgWtPf9CsQQcuz+hMItXGKXxJiU+66ACc4yuJGaSN2ViXtezBkyV89RFluFaBgMCY+Q== X-Received: by 2002:a0c:a366:: with SMTP id u93mr15604735qvu.53.1607438582389; Tue, 08 Dec 2020 06:43:02 -0800 (PST) Received: from turing-police ([2601:5c0:c380:d61::359]) by smtp.gmail.com with ESMTPSA id c7sm3115350qkm.99.2020.12.08.06.43.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 08 Dec 2020 06:43:00 -0800 (PST) From: "Valdis Kl=?utf-8?Q?=c4=93?=tnieks" X-Google-Original-From: "Valdis Kl=?utf-8?Q?=c4=93?=tnieks" X-Mailer: exmh version 2.9.0 11/07/2018 with nmh-1.7+dev To: John Wood Subject: Re: [RFC PATCH 2/2] security/brute.c: Protect the stats pointer In-Reply-To: <20201208103557.6471-3-john.wood@gmx.com> References: <20201208103557.6471-1-john.wood@gmx.com> <20201208103557.6471-3-john.wood@gmx.com> Mime-Version: 1.0 Date: Tue, 08 Dec 2020 09:42:59 -0500 Message-ID: <4593.1607438579@turing-police> Cc: keescook@chromium.org, kernelnewbies@kernelnewbies.org X-BeenThere: kernelnewbies@kernelnewbies.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Learn about the Linux kernel List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============4841390965710607146==" Errors-To: kernelnewbies-bounces@kernelnewbies.org --===============4841390965710607146== Content-Type: multipart/signed; boundary="==_Exmh_1607438579_3488P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit --==_Exmh_1607438579_3488P Content-Type: text/plain; charset=us-ascii On Tue, 08 Dec 2020 11:35:57 +0100, John Wood said: > I think the stats pointer present in the task_struct's security blob > needs to be protected against concurrency for the following reasons. > > 1.- The same process forking at the same time in two different CPUs. > 2.- The same process execve() at the same time in two different CPUs. OK, I'll bite. How would these two cases even happen? (Note that you could conceivably issue the fork()/exeve() on one CPU, run kernel code for a bit and then get rescheduled onto a different CPU to complete the syscall, but that's a different cache coherency can-o-worms :) (Your case 3 of a fork/exec while you traverse is an actual issue. Note that you missed one case - where the process evaporates for some reason while you do the traverse and you're left with a stale pointer...) --==_Exmh_1607438579_3488P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Comment: Exmh version 2.9.0 11/07/2018 iQIVAwUBX8+Q8gdmEQWDXROgAQKZPQ/9FurGiYnZ/bFs1zuX8gQAWsn4tpyHp3t/ HXVfprUv5UYypgALHsa33dmwESLCR2mJcvG8gNNPxq5bf8A3Cyi9vpfTLcjXzH5s 4hkyipLxEQhDG33IHcoZSq3YFrnQQ+Fx+3UT1G83RK3lHHpdXic0WHWPYi6vQPaI AUzNXXMC97TCWUA2DrasVokPKH9c32TDU9ozQ/CI+zv6suG3dftd3UUYZOp6q5Ab 4L7rDGKsRxDmObj4jrM1ywD3Uu+o79uJvnyErCVK22nVR7SwprmeLm7XokDFDG3b 4oGwzAn6zr2huTP8p4IvQ99y2fTy/vUfNOs+m0VKuMi2f3Qs2KAEUaBA0QiOXynl zuH8QCZsFQRigRemp8f3+TYJYw28khCbIx+v41U+jqTzqg5bAuSHzUXEUmCyN7/O h5N4WMbzoJONCp3fZ7eEn2N/eok24rWgjE0avFVfmFq/KgeE4dW2Xn4Sk4Qb8l48 NVav/dHQUtmlQxAQXnm+BUa94gwb29uoHi59iKTULOmZUTbTmA+az8iIbldelxRp e/UECIEx2nIbpO2K9vfdZ2ORoevtOqAI3DUGOEYJNpW9vu7bYP1mJ6fC8SzVci9U /GjtYAbOBu+98KHzzS1Qeibzs9YZbwDrPrcl5hcxdvCWQayr7CO4+Non4LWbw/Gw 4XPhDCZXhpQ= =otYP -----END PGP SIGNATURE----- --==_Exmh_1607438579_3488P-- --===============4841390965710607146== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies --===============4841390965710607146==--