Re: [Security] [PATCH] nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Mar 4, 2011 at 11:33 AM, J. Bruce Fields <bfields@xxxxxxxxxxxx> wrote:
>
> So I assumed the slab allocator would hold a reference to the page like
> any other user would, in which case the tcp code could take a second
> reference of its own.

So the reason that wouldn't work is simple: the reference is obviously
at a page level, but slab doles out allocations on its own level.

What does that mean? Imagine if the network layer takes a ref on the
page, but then the original user does a "kfree()". The _page_ would
stay around (we have a ref from it - but so does the slab allocator),
but the thing is, the slab allocator will release and then re-use the
slab entry.

So the "hold a reference to the page" doesn't actually _help_. The
problem isn't the page going away, it's the smaller slab-allocation
being reused for something else - so the page-level ref would be
useless.

So page-level references really only do work with page allocators.
They don't know about the allocation patterns within a page that slab
does.

                     Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Filesystem Development]     [Linux USB Development]     [Linux Media Development]     [Video for Linux]     [Linux NILFS]     [Linux Audio Users]     [Yosemite Info]     [Linux SCSI]

  Powered by Linux