From: Eric Dumazet <eric.dumazet@gmail.com>
To: Changli Gao <xiaosuo@gmail.com>
Cc: David Miller <davem@davemloft.net>,
hagen@jauu.net, wirelesser@gmail.com, netdev@vger.kernel.org,
Dan Rosenberg <drosenberg@vsecurity.com>
Subject: Re: [PATCH net-next-2.6] filter: add a security check at install time
Date: Thu, 02 Dec 2010 12:15:48 +0100 [thread overview]
Message-ID: <1291288548.2871.51.camel@edumazet-laptop> (raw)
In-Reply-To: <AANLkTikkeQNzTMs_AifJFFU3oEKAmMBaCO9PCRWLRTSo@mail.gmail.com>
Le jeudi 02 décembre 2010 à 18:10 +0800, Changli Gao a écrit :
> > (By the way, I believe FreeBSD has the security problem Dan reported to us)
>
> Yes. it doesn't do this check.
>
Their scratch memory is not on stack but part of the filter, so no
security problem (You can only read previous values of scratch registers
written by your own filter on handling a previous packet.)
This means it is either run on a single CPU, or there is a hidden SMP
bug in their implementation.
next prev parent reply other threads:[~2010-12-02 11:15 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-30 9:22 multi bpf filter will impact performance? Rui
2010-11-30 9:34 ` Eric Dumazet
[not found] ` <AANLkTi=VpmnrXTBNV7McQm6mq9ULT7KTKbM8_hLPoL=2@mail.gmail.com>
[not found] ` <1291127670.2904.96.camel@edumazet-laptop>
2010-12-01 3:48 ` Rui
2010-12-01 4:03 ` Eric Dumazet
2010-12-01 7:45 ` [PATCH net-next-2.6] filter: add SKF_AD_RXHASH and SKF_AD_CPU Eric Dumazet
2010-12-01 8:03 ` Changli Gao
2010-12-06 21:02 ` David Miller
2010-12-03 9:40 ` multi bpf filter will impact performance? Junchang Wang
2010-12-01 7:36 ` Changli Gao
2010-12-01 7:47 ` Eric Dumazet
2010-12-01 7:59 ` Changli Gao
2010-12-01 8:09 ` Eric Dumazet
2010-12-01 8:15 ` Changli Gao
2010-12-01 8:42 ` Eric Dumazet
2010-12-01 17:22 ` Hagen Paul Pfeifer
2010-12-01 18:18 ` David Miller
2010-12-01 18:24 ` David Miller
2010-12-01 18:24 ` Eric Dumazet
2010-12-01 18:44 ` David Miller
2010-12-01 19:48 ` Eric Dumazet
2010-12-01 20:23 ` David Miller
2010-12-01 20:45 ` [PATCH net-next-2.6] filter: add a security check at install time Eric Dumazet
2010-12-02 2:30 ` Changli Gao
2010-12-02 6:46 ` Eric Dumazet
2010-12-02 8:11 ` Changli Gao
2010-12-02 8:53 ` Eric Dumazet
2010-12-02 9:00 ` Eric Dumazet
2010-12-02 9:10 ` Changli Gao
2010-12-02 9:54 ` Eric Dumazet
2010-12-02 10:10 ` Changli Gao
2010-12-02 11:15 ` Eric Dumazet [this message]
2010-12-02 11:29 ` Changli Gao
2010-12-02 13:14 ` Eric Dumazet
2010-12-02 10:59 ` Changli Gao
2010-12-06 21:07 ` David Miller
2010-12-03 6:32 ` multi bpf filter will impact performance? Eric Dumazet
2010-12-05 20:53 ` PATCH] filter: fix sk_filter rcu handling Eric Dumazet
2010-12-05 21:08 ` Andi Kleen
2010-12-05 21:28 ` Eric Dumazet
2010-12-06 17:29 ` David Miller
2010-11-30 10:01 ` multi bpf filter will impact performance? Eric Dumazet
2010-11-30 11:17 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1291288548.2871.51.camel@edumazet-laptop \
--to=eric.dumazet@gmail.com \
--cc=davem@davemloft.net \
--cc=drosenberg@vsecurity.com \
--cc=hagen@jauu.net \
--cc=netdev@vger.kernel.org \
--cc=wirelesser@gmail.com \
--cc=xiaosuo@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox