From: Jason Gunthorpe [mailto:jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org]
Sent: Wednesday, May 25, 2016 11:52 PM

quoted

I want the core ioctl framework to do this:

1. Map user objects to/from the kernel to validate pointers.
2. Provide reference counting on such objects, in order to protect against the

user attempting to destroy objects that are in use.

quoted

3. Provide protection that the state of an object is not driven in two different

directions.

quoted

4. Safely process the removal of the underlying driver or device.
5. Support driver specific operations to the kernel.
6. Report events from multiple sources to a single file descriptor.
7. Minimize the kernel footprint for allocated kernel objects.
8. Minimize the code path needed to process any ioctl, without greatly

affecting maintainability.

quoted

9. Copy ioctl input/output data to/from the kernel.

I agree with all of this as a suitable goal for the common dispatch/marshal
framework.

The goals are OK.
However, I think that processing object locking before validation is not secure.
A malicious user could easily cause a deadlock due to ordering.

Rather, IDR processing should be offered as helper functions to method handlers *after* parameter validation.
This also removes the need to pass arrays of objects separately from the command attributes, which looks cumbersome.

I hope that we can show this in our next revision.
--Liran

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html