Re: [GIT PULL] kdbus for 4.1-rc1

[Andy Lutomirski <luto@amacapital.net>]

On Apr 15, 2015 6:04 PM, "Al Viro" <viro@zeniv.linux.org.uk> wrote:
>
> On Wed, Apr 15, 2015 at 05:47:18PM -0700, Andy Lutomirski wrote:
>
> > I wonder if we could get away with having the receiver pre-allocate
> > some placeholder fds and then have the kernel replace a placeholder
> > with a passed fd immediately when the fd is sent and enqueue *that* in
> > the cmsg data.  If you send an fd to someone who hasn't assigned any
> > placeholders to the receiving socket, then you get an error.
>
> *UGH*
>
> It's a really bad idea.  The thing is, descriptor table that isn't shared
> is assumed to be unchanged.  So when fdget() looks a file up, it doesn't
> have to bump its refcount - the reference in descriptor table itself will
> stay.  Conversely, fdput() doesn't have to drop it in such case (we encode
> whether we need to drop into struct fd returned by fdget() and passed to
> fdput()).
>
> That relies on no third-party modifications of descriptor table and yes,
> the effect _is_ noticable - playing with struct file refcounts does result
> in considerable overhead.
>
> If recepient sits in "gimme a descriptor", we are fine - if descriptor table
> was shared, the other users would be doing full refcount song and dance and
> if it wasn't, recepient is the sole user _and_ it isn't betwee fdget() and
> fdput() at the moment.  With your "replace the dummies when sending" trick
> we break all of that - we don't know what the recepient is doing at the moment
> and for all we know they might be in the middle of something like e.g.
> fstat() on your placeholder.  With rather unpleasant effects...

Hmm.

I don't love the special blocking call either -- it break polling loops.

We could have the existence of a placeholderfd count as an extra
reference to the descriptor table, with the associated performance
hit.  Or we could allow each placeholderfd to collect one received fd
but not actually switch over.  The latter is ugly and still has minor
DoS issues -- we'd have to prevent placeholderfds from being passed
through this mechanism or SCM_RIGHTS.

But wait... what about an evil trick?  What if all placeholderfds are
the *same* struct file and that struct file is never deleted?  Then
fdget on a placeholderfd is safe, since it's implicitly pinned.

--Andy