Date: Sat, 4 Oct 2014 19:25:23 +0000 From: "Bjoern A. Zeeb" <bz@FreeBSD.org> To: Konstantin Belousov <kostikbel@gmail.com> Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, Mateusz Guzik <mjg@FreeBSD.org> Subject: Re: svn commit: r272505 - in head/sys: kern sys Message-ID: <23D87C79-1101-4E37-AA49-1C7FA8AC5C0F@FreeBSD.org> In-Reply-To: <20141004163633.GT26076@kib.kiev.ua> References: <201410040808.s9488uAI099166@svn.freebsd.org> <42180557-0119-4597-9492-662E1671A840@FreeBSD.org> <20141004163633.GT26076@kib.kiev.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
On 04 Oct 2014, at 16:36 , Konstantin Belousov <kostikbel@gmail.com> = wrote: > On Sat, Oct 04, 2014 at 02:21:54PM +0000, Bjoern A. Zeeb wrote: >>=20 >> On 04 Oct 2014, at 08:08 , Mateusz Guzik <mjg@FreeBSD.org> wrote: >>=20 >>> Author: mjg >>> Date: Sat Oct 4 08:08:56 2014 >>> New Revision: 272505 >>> URL: https://svnweb.freebsd.org/changeset/base/272505 >>>=20 >>> Log: >>> Plug capability races. >>>=20 >>> fp and appropriate capability lookups were not atomic, which could = result in >>> improper capabilities being checked. >>>=20 >>> This could result either in protection bypass or in a spurious = ENOTCAPABLE. >>>=20 >>> Make fp + capability check atomic with the help of sequence = counters. >>>=20 >>> Reviewed by: kib >>> MFC after: 3 weeks >>>=20 >>> Modified: >>> head/sys/kern/kern_descrip.c >>> head/sys/sys/filedesc.h >>> ? >>=20 >>=20 >> This file is included from user space. There is no opt_capsicum.h = there. >> Including an opt_* in the header file seems wrong in a lot of ways = usually. > I think that easiest, and probably the most correct, fix is to include > the fde_seq member unconditionally. >=20 >>=20 >> I tried to add a bandaid for the moment with r272523 which (to be = honest) makes it worse. >>=20 >> This needs a better fix. > Hm, I do see inclusion of sys/filedesc.h in the usermode programs, = most > worrying is libprocstat. But, there is nothing useful for usermode in = the > header, except possibly for the code with inspects KVA. It=92s included indirectly imho through other sys/* header files if I = am not mistaken. >=20 >>=20 >>=20 >> I also wonder why the (conditional) fde_seq ended up at the beginning = of the structure rather than the end? >>=20 > Why not ? Because it guarantees the structure layout (offsets) to change for = either way, where-as at the end things would at least be deterministic = for the beginning; it might not make a change in reality, but it=92s = nice anyway (also for debugging). =97=20 Bjoern A. Zeeb "Come on. Learn, goddamn it.", WarGames, 1983
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?23D87C79-1101-4E37-AA49-1C7FA8AC5C0F>