Re: [PATCH/RFC 2.6.21 3/5] ehca: completion queue: remove use of do_mmap()

Hi,
+ if (my_cq->ownpid != cur_pid) {
+ ehca_err(device, "Invalid caller pid=%x ownpid=%x "
+ "cq_num=%x",
+ cur_pid, my_cq->ownpid, my_cq->cq_number);
+ return -EINVAL;
+ }

(for other reviewers: this is not new code, just moved around)

Owner tracking by pid is really dangerous. File descriptors can be
passed around by unix sockets, a single process can have files open
more than once, etc..

It seems ehca wants to prevent threads other than the creating one
from performing most operations. Can you explain the reason for this?
you point to the right spot... This has a historic reason as we
have needed to support fork(), system("date") etc for kernel 2.6.9,
hence those vma flags manipulation and this pid checking as proactive
protection/restriction. For newer kernel, I guess >=2.6.12, this checking
were not necessary, but we would feel better after we had tested user
space stuff more thoroughly without this piece of code. Since this is
not new code, can we pls handle this later?
Regards
Nam
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: RFC [patch 13/34] PID Virtualization Define new task_pid api
    ... >> Any place the kernel saves a pid and then proceeds to signal it later. ... > Through some method of signaling the kernel a ... A pointer to a task_struct while it kind of sort of works. ...
    (Linux-Kernel)
  • [UNIX] OpenBSD File Descriptor Vulnerability (Additional Details)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... kernel checks closed file descriptors 0-2 (when running a setuid program), ...
    (Securiteam)
  • kernel BUG at fs/jbd/commit.c:760!
    ... kernel BUG at fs/jbd/commit.c:760! ... Stack traceback for pid 297 ... kdb> btp 7346 ...
    (Linux-Kernel)
  • Re: Thread and process dentifiers (CPU affinity, kill)
    ... > that PID, ... In the kernel, I think this ... > means that kill() should actually be looking up tgids rather than pids. ... well I guess the current way it works you can set the affinity per ...
    (Linux-Kernel)
  • Re: [PATCH 0/16] Pid namespaces
    ... | configurable, zero overheaded;) pid namespaces. ... | The namespace are organized as a tree - once a task is cloned ... Suka's patches change the kernel/pid.c code too heavy. ... | numerical pid from the kernel at all. ...
    (Linux-Kernel)