From owner-svn-src-head@FreeBSD.ORG Sat Oct 4 16:36:39 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 1FAD93FB; Sat, 4 Oct 2014 16:36:39 +0000 (UTC) Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 86FF18D6; Sat, 4 Oct 2014 16:36:38 +0000 (UTC) Received: from tom.home (kostik@localhost [127.0.0.1]) by kib.kiev.ua (8.14.9/8.14.9) with ESMTP id s94GaXki043686 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 4 Oct 2014 19:36:33 +0300 (EEST) (envelope-from kostikbel@gmail.com) DKIM-Filter: OpenDKIM Filter v2.9.2 kib.kiev.ua s94GaXki043686 Received: (from kostik@localhost) by tom.home (8.14.9/8.14.9/Submit) id s94GaXvM043685; Sat, 4 Oct 2014 19:36:33 +0300 (EEST) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com using -f Date: Sat, 4 Oct 2014 19:36:33 +0300 From: Konstantin Belousov To: "Bjoern A. Zeeb" Subject: Re: svn commit: r272505 - in head/sys: kern sys Message-ID: <20141004163633.GT26076@kib.kiev.ua> References: <201410040808.s9488uAI099166@svn.freebsd.org> <42180557-0119-4597-9492-662E1671A840@FreeBSD.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <42180557-0119-4597-9492-662E1671A840@FreeBSD.org> User-Agent: Mutt/1.5.23 (2014-03-12) X-Spam-Status: No, score=-2.0 required=5.0 tests=ALL_TRUSTED,BAYES_00, DKIM_ADSP_CUSTOM_MED,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED autolearn=no autolearn_force=no version=3.4.0 X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on tom.home Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org, Mateusz Guzik X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Oct 2014 16:36:39 -0000 On Sat, Oct 04, 2014 at 02:21:54PM +0000, Bjoern A. Zeeb wrote: > > On 04 Oct 2014, at 08:08 , Mateusz Guzik wrote: > > > Author: mjg > > Date: Sat Oct 4 08:08:56 2014 > > New Revision: 272505 > > URL: https://svnweb.freebsd.org/changeset/base/272505 > > > > Log: > > Plug capability races. > > > > fp and appropriate capability lookups were not atomic, which could result in > > improper capabilities being checked. > > > > This could result either in protection bypass or in a spurious ENOTCAPABLE. > > > > Make fp + capability check atomic with the help of sequence counters. > > > > Reviewed by: kib > > MFC after: 3 weeks > > > > Modified: > > head/sys/kern/kern_descrip.c > > head/sys/sys/filedesc.h > > ? > > > This file is included from user space. There is no opt_capsicum.h there. > Including an opt_* in the header file seems wrong in a lot of ways usually. I think that easiest, and probably the most correct, fix is to include the fde_seq member unconditionally. > > I tried to add a bandaid for the moment with r272523 which (to be honest) makes it worse. > > This needs a better fix. Hm, I do see inclusion of sys/filedesc.h in the usermode programs, most worrying is libprocstat. But, there is nothing useful for usermode in the header, except possibly for the code with inspects KVA. > > > I also wonder why the (conditional) fde_seq ended up at the beginning of the structure rather than the end? > Why not ?