max_k

8 ms·

31.
by max_k 4y ago
> do you use exceptions? Exceptions, sorry. I learned C++ in the early 90ies, but didn't like it much; I needed to do plain C for a few years at dayjob and several open source projects until I was fed up with manual error handling a
32.
by max_k 4y ago
> Would you consider adding a kqueue implementation? Can't do, I don't have Apple or BSD anywhere. But if code for it were submitted to me, I would gladly merge it (and try to keep the CI happy). The MPD version of the event lo
33.
by max_k 4y ago
Whoa, that exists? How about having some nerd fun and we create a PR for each other's open source project?
34.
by max_k 4y ago
I love C++ coroutines! (The spec has a few warts and gives me enough reasons to hate them, like not being able by definition to properly inline nested coroutine calls, but I love them anyway.) I've written several libraries for integra
35.
by max_k 5y ago
No, the disk is not involved in this vulnerability. It happens only in RAM (the page cache).
36.
by max_k 5y ago
There's also "anonymous memory" (as opposed to memory mapped from a file, which you could call "named memory").
37.
by max_k 5y ago
> pipe flag “PIPE_BUF_FLAG_CAN_MERGE”, which signifies that the data buffer inside the pipe can be merged, i.e, this flag notifies the kernel that the changes which are written to the page cache pointed to by the pipe shall be written ba
38.
by max_k 5y ago
Took a long while until I found the right state of mind to finally understand what was causing those (rare) file corruptions. Once I figured that out, the rest was easy :-)
39.
by max_k 5y ago
Then let's have those 2 or 3 documented init functions. That's not perfect, but still much better than spraying different (undocumented) copies of the init code everywhere, that have to be located and adjusted every time somebody
40.
by max_k 5y ago
> I don't think you have much insight into this. I don't think you know who wtarreau is.
41.
by max_k 5y ago
What does "streaming buffers" mean? splice() avoids copying data from kernel to userspace and back; it stays in the kernel, and often isn't even copied at all, only page references are passed around.
42.
by max_k 5y ago
Yes, but as you said, it works only after adding such annotations to various libraries. A circular buffer is just a special kind of memory allocator, and as such, when it allocates and deallocates memory, it needs to tell the sanitizer abou
43.
by max_k 5y ago
Interesting compiler feature to work around (unknown) vulnerabilities similar to this one. However in this case, it wouldn't help; the initial allocation is with explicit zero-initialization, but this is a circular buffer, and the prob
44.
by max_k 5y ago
Agree, but even 100% test coverage can't catch this kind of bug. I don't know of any systematic testing method which would be able to catch it. Maybe something like valgrind which detects accesses to uninitialized memory, but then
45.
by max_k 5y ago
There's no bug in that commit, the commit is correct, it only makes the bug exploitable. The buggy commit is older, it's https://github.com/torvalds/linux/commit/241699cd72a8489c944... but not explo
46.
by max_k 5y ago
Your post sounds like it's a bad thing, but "nicer" code is easier to maintain, i.e. there will be fewer bugs (and fewer vulnerabilities). This bug is an exception of the rule - shit happens. But refactoring code to be "
47.
by max_k 5y ago
btw. this is how I would make the code more robust: https://lore.kernel.org/lkml/20220225185431.2617232-4-max.ke... I'm a C++ guy, and the lack of constructors is one of many things that bothers me with C.
48.
by max_k 5y ago
Yes, that's what I did.
49.
by max_k 5y ago
Yes. I have a working exploit, but havn't published it (yet).
50.
by max_k 5y ago
> require all fields to be initialized any time an object is created I'm not a fan of such a policy. That usually leads to people zero-initializing everything. For this bug, this would have been correct, but sometimes, there is no g
51.
by max_k 5y ago
Yes. But you can also inject code into libc.so.6, and all running processes will have it.
52.
The Dirty Pipe Vulnerability(dirtypipe.cm4all.com)
697 points by max_k 5y ago|240 comments