[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120217175445.GC29902@kroah.com>
Date: Fri, 17 Feb 2012 09:54:45 -0800
From: Greg KH <gregkh@...uxfoundation.org>
To: Vasiliy Kulikov <segoon@...nwall.com>
Cc: kernel-hardening@...ts.openwall.com, Kees Cook <keescook@...omium.org>,
Ubuntu security discussion <ubuntu-hardened@...ts.ubuntu.com>,
linux-kernel@...r.kernel.org, David Windsor <dwindsor@...il.com>,
pageexec@...email.hu, spender@...ecurity.net
Subject: Re: Re: Add overflow protection to kref
On Fri, Feb 17, 2012 at 11:59:45AM +0400, Vasiliy Kulikov wrote:
> Hi,
>
> > And in all that time, I've never seen an instance where you can overflow
> > the reference count,
>
> Do you mean that the overflow is theoretically impossible or that this
> type of programmer error is rare?
>
> If the former, it is only 2**32 incs - if you can find open() implementation
> with a missing atomic_dec() in error path and you can call open() faster than
> 10000 times per second, you can overflow the counter in ~4 days.
>
> If the latter, it is just a question of finding missing put() in some triggerable
> error path. Kees has already posted a link to a bug with a missing fput().
I'm referring to the fact that the use of kref in this type of error or
problem is rare.
Yes, we have these types of problems at times, but a kref doesn't seem
to be involved in them that I know of, so changing the kref code
wouldn't help here from what I can tell.
thanks,
greg k-h
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
