RE: [RFC] rdma/uverbs: Sketch for an ioctl framework

Liran Liss
2016-05-26T18:07:02Z

> From: Jason Gunthorpe [mailto:jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org]
> Sent: Wednesday, May 25, 2016 11:52 PM

> >
> > I want the core ioctl framework to do this:
> >
> > 1. Map user objects to/from the kernel to validate pointers.
> > 2. Provide reference counting on such objects, in order to protect against the
> user attempting to destroy objects that are in use.
> > 3. Provide protection that the state of an object is not driven in two different
> directions.
> > 4. Safely process the removal of the underlying driver or device.
> > 5. Support driver specific operations to the kernel.
> > 6. Report events from multiple sources to a single file descriptor.
> > 7. Minimize the kernel footprint for allocated kernel objects.
> > 8. Minimize the code path needed to process any ioctl, without greatly
> affecting maintainability.
> > 9. Copy ioctl input/output data to/from the kernel.
>
> I agree with all of this as a suitable goal for the common dispatch/marshal
> framework.
>

The goals are OK.
However, I think that processing object locking before validation is not secure.
A malicious user could easily cause a deadlock due to ordering.

Rather, IDR processing should be offered as helper functions to method handlers *after* parameter validation.
This also removes the need to pass arrays of objects separately from the command attributes, which looks cumbersome.

I hope that we can show this in our next revision.
--Liran