5 ms·
>Why would it be any more of an issue than calling a blocking exec? Now you turn everything doing fast I/O into something that's essentially an easier rwx situ
by swiley 5y ago
>Why would it be any more of an issue than calling a blocking exec?
Now you turn everything doing fast I/O into something that's essentially an easier rwx situation WRT memory corruption.
>Much nicer
In other words: the runtime should handle it because the kernel doesn't need to.
- the_duke 5y agoI really don't follow your thought process here. Can you expand on your objections? io_uring can really be thought of as a generic asynchronous syscall interface. It uses a kernel thread pool to run operations. If something is blocking on a kernel-level it can just be run as a blocking operation on that thread pool.
- wtallis 5y agoI think the concern is that if you can manage an exploit that injects data into an io_uring submission queue, you may be able to plant an exec call or similar. But such an exploit would need to rely on a well-formed malicious SQE being submitted to the kernel without being overwritten by the SQE the application intended to submit, which probably requires also gaining control over the application's pointers for where in the queue it will write the next SQE it constructs.
- Aissen 5y agoMeh, I'm a bit skeptic. Memory corruption of ring buffer could make it possible to inject exec syscalls. So, like any other memory corruption ? Also, io_uring already supports open/read/write which is often enough to convert to execution.