On Mon, Mar 16, 2015 at 10:24:30AM -0400, Steven Rostedt wrote:
> On Mon, 16 Mar 2015 15:19:39 +0100
> Peter Zijlstra <pet...@infradead.org> wrote:
>
> >
> > I suppose this is an unprivileged syscall; so what do we do about:
> >
> > for (;;)
> > sys_membar(EXPEDITED);
> >
> > Which would spray the entire system with IPIs at break neck speed.
>
> Perhaps it should be rate limited. Have parameters (controlled via
> sysctl) that will only allow so many of these per ms. If it exceeds it,
> then the call will end up being a schedule_timeout() till it is allowed
> to continue. Thus, the above will spit out a few hundred IPIs, then
> sleep for a millisecond, and then spit out another hundred IPIs and
> sleep again.
>
> That would prevent any DoS attacks.
But this would only qualify as a DoS if MEMBARRIER_EXPEDITED_FLAG and
!MEMBARRIER_PRIVATE_FLAG. Otherwise, the user's process is only DoSing
itself, which is that user's problem, not anyone else's. And it looks
like the current patch refuses to implement this DoS case, unless I am
really confused about the code in membarrier_expedited(). And in fact
membarrier_validate_flags() checks for this DoS case and returns -EINVAL.
So I do not believe that this syscall permits that type of DoS.
What am I missing here?
Thanx, Paul
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
