From: Dustin Kirkland <dustin.kirkland@gazzang.com>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: dragonylffly <dragonylffly@163.com>,
tyhicks@canonical.com, john.johansen@canonical.com,
ecryptfs@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] eCryptfs: infinite loop bug
Date: Thu, 19 Jan 2012 10:17:55 -0600 [thread overview]
Message-ID: <CANT6BaO418KViOgCj11qCKi8keZ+tqbEAkCvBFvwNF4EtUziEA@mail.gmail.com> (raw)
In-Reply-To: <CA+55aFx7CV8wpDLfCr-pVVRxRyYgd2QdRXJSmp+UgrjSHyB1eA@mail.gmail.com>
On Wed, Jan 18, 2012 at 2:49 PM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
> There are *two* cases where we do that "total_remaining_bytes"
> calculation. The same bug seems to exist both in ecryptfs_read() and
> ecryptfs_write().
>
> Possibly only the ecryptfs_write() one leads to an endless loop, but
> the read one looks suspicious too.
>
> Also, what protects things against this just being one nasty DoS
> attack - even if the code is fixed to not be an endless loop, it looks
> like a trivial "truncate()" can be used to generate a *practically*
> infinite write stream. At the very least, this should be KILLABLE. Or
> did I mis-read the code?
>
> Tyler, Dustin, others - comments? This looks nasty.
Definitely nasty, Linus. This is almost certainly the source of a
long-standing bug [1] we've had with tor-downloads into eCryptfs
mounts hanging the OS. Tor clients truncate a file at the start of
the download large enough to handle the eventual result.
Glad to see this finally triaged and a fix in the works, Li Wang and
Yunchuan Wen. Thanks for that.
[1] https://bugs.launchpad.net/ecryptfs/+bug/431975
--
:-Dustin
Dustin Kirkland
Chief Architect
Gazzang, Inc.
www.gazzang.com
next prev parent reply other threads:[~2012-01-19 16:18 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <7f1e961d.f528.134efaf8348.Coremail.dragonylffly@163.com>
2012-01-18 20:49 ` [PATCH] eCryptfs: infinite loop bug Linus Torvalds
2012-01-18 21:04 ` Tyler Hicks
2012-01-19 16:17 ` Dustin Kirkland [this message]
2012-01-18 7:30 Li Wang
2012-01-18 15:26 ` Cong Wang
2012-01-18 21:40 ` Tyler Hicks
2012-01-19 3:43 ` Linus Torvalds
[not found] ` <526922120.05125@eyou.net>
2012-01-19 1:44 ` Li Wang
2012-01-19 8:48 ` Tyler Hicks
2012-01-19 14:03 ` Dustin Kirkland
2012-01-19 15:08 ` Tyler Hicks
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CANT6BaO418KViOgCj11qCKi8keZ+tqbEAkCvBFvwNF4EtUziEA@mail.gmail.com \
--to=dustin.kirkland@gazzang.com \
--cc=dragonylffly@163.com \
--cc=ecryptfs@vger.kernel.org \
--cc=john.johansen@canonical.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tyhicks@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).