Live data from Hacker News

size_t-to-int vulnerability in Linux’s filesystem layer

openwall.com

271–280 of 280 posts

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#271
post #186

Earlier quoted context omitted.

>The C language is 49 years old. That’s my point, no shade on K&R though.

meanwhile, lisp. age is orthogonal to good design.

As if I hate lisp…

I was just excusing K&R from the realization we have now in the 2020s, and I would obviously afford the same leniency to John McCarthy and lisp.

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#272

I’m still amazed that we allow compilation of so obviously faulty programs. It’s like you sent a 1kg package through the postal service, and then the recipient gets an envelope containing a piece of cardboard from the original packaging.. And everyone involved is somehow A-OK with all of this. If your programming language silently converts between types (in any direction), just to accommodate the programmer, instead…

> you simply have failed as a programming language designer That's some hubris. The C language is 49 years old. Dennis Ritchie made reasonable design decisions for the time he found himself in. I think we should be understanding of that, and the network effects that lead to large parts of the world's critical software infrastructure being implemented in C. I don't think he failed at anything. I used to be a C develop…

> That's some hubris.

How?

Or have you, completely on your own, decided that my criticism of programming language design in the 2020s is somehow applicable to languages “literally” designed in the 1970s?

Why not go one step further and deny Alan Turing and Alonzo Church, and their achievements…?

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#273
post #265

Earlier quoted context omitted.

Ok so we're going to keep shifting the goalposts, now it's "there aren't enough beginners relative to total usage so beginner friendly IDE isn't enough"... I mean MSVS uses Clang-tidy too, Clang-tidy integrates style guides provided by Mozilla and Google. Most C++ Google projects have clang-tidy configs. Clang-tidy is literally table-stakes for modern C++ tooling. Github shows 970,000 commits related to setting up cl…

I’m definitely not moving any goalposts I know of! I thought the point I had been making, as had others, is that by default this is an easy footgun. There are all sorts of things that can be added on to all languages to help - if you know it’s a problem worth solving, etc. which is inevitably after you’ve footgunned yourself with it bad enough you felt the need to research how to prevent it. Other languages just do t…

There was one point, C++ won't warn you by default .

But tooling that is incredibly common, that beginners will run into even if they take the path of least resistance, and experts will use because it enforces standards at the very least, covers it.

Like Js without linters is a minefield, but everyone accepts you should lint your Js. Why does that change when C++ is involved?

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#274

Earlier quoted context omitted.

I dont think kernel handles NPEs: https://stackoverflow.com/questions/63091446/what-happens-at...

From your link: A NULL pointer in most (but not all) C implementations is address 0. Normally this address is not in a valid (mapped) page. Any access to a virtual page that's not mapped by the HW page tables results in a page-fault exception. e.g. on x86, #PF. This invokes the OS's page-fault exception handler to resolve the situation.

Yes, page fault exceptions happen within the CPU, they cannot happen in software. I think of it as C is close to assembly and does not check every memory address is referencing. It just compiles and CPU starts running it. If somehow a memory of 0 is dereferenced, it is already run by the CPU in its fetch/decode cycle. but of course once the excetion happens, Kernel is responsible for killing the actual process. So both CPU and kernel do it together.

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#275

Earlier quoted context omitted.

But should it be everywhere including the fs/virtual fs layer? Could we limit it only to device drivers? Not a kernel expert here and would love to hear thoughts.

This doesn't have anything to do with filesystems or kernels. The x86 assembly uses fixed width immediates. CPU registers are a fixed width. For any code to compile and run, it needs to make decisions about how large stack frames need to be, and how much heap memory to allocate. This was the parent's point about abstractions. You can make a library that pretends to be a variable sized integer, but to implement such a…

Yes totally, but FS is a Kernel abstraction, it deals with questions like: How to keep a directory? How to keep a file? How to keep synlinks. Etc,

These can be implemented in any higher level language or within C without using fixed width numerals if correct abstractions were available. Only device control parts should use fixed with numerals in my opinion.

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#276

Earlier quoted context omitted.

This doesn't have anything to do with filesystems or kernels. The x86 assembly uses fixed width immediates. CPU registers are a fixed width. For any code to compile and run, it needs to make decisions about how large stack frames need to be, and how much heap memory to allocate. This was the parent's point about abstractions. You can make a library that pretends to be a variable sized integer, but to implement such a…

Yes totally, but FS is a Kernel abstraction, it deals with questions like: How to keep a directory? How to keep a file? How to keep synlinks. Etc, These can be implemented in any higher level language or within C without using fixed width numerals if correct abstractions were available. Only device control parts should use fixed with numerals in my opinion.

The problem is syscall interfaces are facilitated through hardware circuits, and as such, you have to work with fixed-width integers. Not only that, but those integers usually have other requirements around alignment and endianness.

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#277
post #92

Earlier quoted context omitted.

keep in mind though that -Weverything is not intended to be used in production: https://quuxplusone.github.io/blog/2018/12/06/dont-use-wever...

-Weverything is great for CI though, in compination with lots of -Wno-... flags to disable warnings you don't want. Instead of having to manually look out for new warning flags you will get all automatically.

Yep, this is what I do; throw in -Weverything followed by a few things like -Wno-packed -Wno-padded -Wno-unused-parameter.

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#278
post #205

Earlier quoted context omitted.

This fix to me reduces the performance for nothing. In Linux (or most general on any UNIX system that I saw) a path should not be longer (total) than PATH_MAX, that is typically defined to 4096 bytes. What is the point on allocating something statically at this point? And yes, I know that really that is only a limit of the system call path lenght, and in theory you can work with longer paths (by changing the current…

> reduces the performance for nothing Does the code in question ever run in a tight loop (e.g. on file operations after the filesystem is mounted), or just at mount time? If it's just at mount time, "reducing performance" by one malloc vs a stack adjustment doesn't seem to me like it should be a primary concern.

We are talking about systemd, that is a core software. I would like systemd to do as few memory allocations as possible. The reason is that memory can run out, especially on embedded devices where you have for example 32Mb of RAM, and you have to properly manage the case that you run out of memory. Most programmers don't, and the program does crash in case you don't have memory available. That is bad for PID 1, because that would mean a kernel panic, that you don't want.

If PID 1 does need to do that kind of stuff (as it seems), I would prefer it to fork a process and do the memory allocation in that, so if that process crashes because you are out of memory the kernel doesn't panic.

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#279
post #227

Earlier quoted context omitted.

This fix to me reduces the performance for nothing. In Linux (or most general on any UNIX system that I saw) a path should not be longer (total) than PATH_MAX, that is typically defined to 4096 bytes. What is the point on allocating something statically at this point? And yes, I know that really that is only a limit of the system call path lenght, and in theory you can work with longer paths (by changing the current…

> In Linux (or most general on any UNIX system that I saw) a path should not be longer (total) than PATH_MAX, that is typically defined to 4096 bytes. That almost sounds like the 260 character windows path limit constant used by some ancient APIs. I would assume that any API limited to that path length is dated and probably unreliable in various contexts as the wikipedia article on filesystems explicitly gives the li…

The filesystem can support path length even infinite (simple, make a symlink of a directory inside that directory, you have an infinite path).

PATH_MAX is a limit of a path that you can pass to the various path manipulating functions, open(), unlink(), etc, or returned by getcwd() (that gives an error if path is longer than PATH_MAX, and yes there are non standard system call to go around this limit but... why?)

You can however use paths longer by PATH_MAX, how? Simply chdir() PATH_MAX, then you can chdir() another PATH_MAX, then count how many software breaks...

Imposing a limit on paths makes sense and should be done. 4096 bytes seems reasonable to me. Also, in that example, it wasn't even a matter of a path! They are parsing it seems only the file name, and that is defined to be NAME_MAX, that is 255 bytes, on every system and every filesystem!

Re: size_t-to-int vulnerability in Linux’s filesystem layer

#280
post #238
post #198

Earlier quoted context omitted.

The Linux kernel doesn't have an actual path limit. Nor does Solaris. PATH_MAX is 4096 in glibc and musl libc because setting to it to something like INT_MAX or ULONG_MAX would break a lot of existing code that uses PATH_MAX to size buffers. (Though Solaris does define it as INT_MAX, IIRC.) OTOH, because of the lack of a hard limit there's also code that relies (if accidentally) on paths longer than PATH_MAX.

Linux does have a limit, at least for some system calls: $ strace -e trace=file perl -e 'open(FH, "

There's a limit to what path string you can make the kernel interpret. That does not limit total path length. Keep looping on mkdirat/openat and you can make very very deep trees. As opposed to your syscall that is relative to an arbitrary directory, /proc/self/mountinfo has to contain the whole absolute path to be useful.
Post reply on HN