lrh2000 / StackRot

CVE-2023-3269: Linux kernel privilege escalation vulnerability
455 stars 38 forks source link

Confusion about the rules #5

Open qrzbing opened 8 months ago

qrzbing commented 8 months ago

Hi, I found in "Regarding concurrent modification" paragraph you say some rules like

an exclusive lock must be held by writers (Rule W)

and so on. If I want to know more about rules, where can I find them? I have searched some introduction on Linux Plumbers Conference (like here) but do not find anything about rules. Am I missing something?

lrh2000 commented 8 months ago

Thank you for your interest in my writeup.

You might want to take a look at the RCU documentation. It says (in the 6. ANALOGY WITH READER-WRITER LOCKING section):

Although [..], a very common use of RCU is analogous to reader-writer locking. [..] Read-side locking moves to rcu_read_lock() and rcu_read_unlock, update-side locking moves from a reader-writer lock to a simple spinlock, and a synchronize_rcu() precedes the kfree().

Ideally, either reader-writer locking or RCU locking is used. However, it's not that simple. Reader-writer locking is powerful, but not efficient enough because writers will block readers. RCU locking is efficient, but not powerful enough to support complex modifications (e.g., editing multiple fields in a large structure and ensuring that all readers don't see inconsistent values among those fields).

The MM subsystem is too complex to use RCU locking alone, and historically it has made extensive use of reader-writer locking (e.g., mmap_read_lock() and mmap_write_lock()). RCU locking and the RCU-safe data structure, i.e., the maple tree, are later introduced to support VMA lock-based page faults. This is done by looking up the VMA only under the RCU lock rcu_read_lock() instead of the reader lock mmap_read_lock().

I'm using Rule W and Rule A1 to reference the rules required by reader-writer locking, and Rule W and Rule A2 to reference the rules required by RCU locking. The rules are named by me for the purpose of easy referencing later, so you may not be able to find these rules elsewhere. However, their meaning can be confirmed in the kernel documentation, as I mentioned above.

Hope this information can help you.