Messages in this thread | | | Subject | Re: Simple kernel attack using socketpair. easy, 100% reproductiblle, works under guest. no way to protect :( | From | Eric Dumazet <> | Date | Thu, 25 Nov 2010 08:14:02 +0100 |
| |
Le jeudi 25 novembre 2010 à 07:28 +0100, Eric Dumazet a écrit :
> > Since you obviously read recent mails on this subject yesterday, why > dont you Cc netdev ? > > There is a very easy way to protect against this actually. > > A patch was posted yesterday, and need some adjustements. > > > diff --git a/net/unix/garbage.c b/net/unix/garbage.c > index c8df6fd..40df93d 100644 > --- a/net/unix/garbage.c > +++ b/net/unix/garbage.c > @@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struct unix_sock *u) > } > > static bool gc_in_progress = false; > +#define UNIX_INFLIGHT_TRIGGER_GC 2000 > > void wait_for_unix_gc(void) > { > + /* > + * If number of inflight sockets is insane, > + * force a garbage collect right now. > + */ > + if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress) > + unix_gc(); > wait_event(unix_gc_wait, gc_in_progress == false); > } > >
Hmm... it seems its another problem, chains are very long so we hit a NMI watchdog.
I guess we should limit to a very small number, like 64, or rewrite the garbage collector to a better algo.
-- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |