Luck, Tony
bef3efbeb8
efivarfs: Limit the rate for non-root to read files ...
Each read from a file in efivarfs results in two calls to EFI
(one to get the file size, another to get the actual data).
On X86 these EFI calls result in broadcast system management
interrupts (SMI) which affect performance of the whole system.
A malicious user can loop performing reads from efivarfs bringing
the system to its knees.
Linus suggested per-user rate limit to solve this.
So we add a ratelimit structure to "user_struct" and initialize
it for the root user for no limit. When allocating user_struct for
other users we set the limit to 100 per second. This could be used
for other places that want to limit the rate of some detrimental
user action.
In efivarfs if the limit is exceeded when reading, we take an
interruptible nap for 50ms and check the rate limit again.
Signed-off-by: Tony Luck <tony.luck@intel.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-02-22 10:21:02 -08:00
bpf: sockmap, fix leaking maps with attached but not detached progs
2018-02-06 11:39:32 +01:00
kernel/cpuset: current_cpuset_is_being_rebound can be boolean
2018-02-06 18:32:47 -08:00
KVM changes for 4.16
2018-02-10 13:16:35 -08:00
signal: Simplify and fix kdb_send_sig
2018-01-03 18:01:08 -06:00
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
irqdomain: Re-use DEFINE_SHOW_ATTRIBUTE() macro
2018-02-16 14:22:34 +00:00
Merge branch 'for-4.16/remove-immediate' into for-linus
2018-01-31 16:36:38 +01:00
locking/qspinlock: Ensure node->count is updated before initialising node
2018-02-13 14:50:14 +01:00
x86/power: Fix swsusp_arch_resume prototype
2018-02-02 23:33:50 +01:00
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
SCSI misc on 20180131
2018-01-31 11:23:28 -08:00
sched/cpufreq: Remove unused SUGOV_KTHREAD_PRIORITY macro
2018-02-13 13:04:03 +01:00
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
kernel/acct.c: fix the acct->needcheck check in check_free_space()
2018-01-04 16:45:09 -08:00
kernel/async.c: revert "async: simplify lowest_in_progress()"
2018-02-06 18:32:44 -08:00
Audit: remove unused audit_log_secctx function
2017-11-10 16:08:47 -05:00
audit/stable-4.15 PR 20171113
2017-11-15 13:28:48 -08:00
Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2017-11-14 14:08:20 -08:00
audit: filter PATH records keyed on filesystem magic
2017-11-10 16:08:56 -05:00
audit/stable-4.15 PR 20171113
2017-11-15 13:28:48 -08:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
cpumask: make cpumask_size() return "unsigned int"
2018-02-06 18:32:45 -08:00
Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2017-12-31 12:30:34 -08:00
kdump: write correct address of mem_section into vmcoreinfo
2018-01-13 10:42:48 -08:00
delayacct: Account blkio completion on the correct task
2018-01-16 03:29:36 +01:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
kernel/exit.c: export abort() to modules
2018-01-04 16:45:09 -08:00
kprobes, x86/alternatives: Use text_mutex to protect smp_alt_modules
2017-11-07 12:20:09 +01:00
error-injection: Support fault injection framework
2018-01-12 17:33:38 -08:00
Merge branch 'akpm' (patches from Andrew)
2018-02-06 22:15:42 -08:00
pids: introduce find_get_task_by_vpid() helper
2018-02-06 18:32:46 -08:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
kernel: make groups_sort calling a responsibility group_info allocators
2017-12-14 16:00:49 -08:00
irq/work: Improve the flag definitions
2018-01-08 19:43:15 +01:00
sched/core: Fix cpu.max vs. cpuhotplug deadlock
2018-01-24 10:03:44 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk
2018-02-01 13:36:15 -08:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
kcov: detect double association with a single task
2018-02-06 18:32:46 -08:00
resource: Provide resource struct in resource walk callback
2017-11-07 15:35:57 +01:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
kprobes: Propagate error from disarm_kprobe_ftrace()
2018-02-16 09:12:58 +01:00
treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts
2017-11-21 16:35:54 -08:00
error-injection: Support fault injection framework
2018-01-12 17:33:38 -08:00
mm: Fix devm_memremap_pages() collision handling
2018-01-19 16:29:56 -08:00
Modules updates for v4.16
2018-02-07 14:29:34 -08:00
padata: add SPDX identifier
2018-01-05 18:43:00 +11:00
kernel/panic.c: add TAINT_AUX
2017-11-17 16:10:04 -08:00
kernel/params.c: improve STANDARD_PARAM_DEF readability
2017-10-03 17:54:26 -07:00
pids: introduce find_get_task_by_vpid() helper
2018-02-06 18:32:46 -08:00
pid: remove pidhash
2017-11-17 16:10:04 -08:00
pids: introduce find_get_task_by_vpid() helper
2018-02-06 18:32:46 -08:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
kernel/reboot.c: add devm_register_reboot_notifier()
2017-11-17 16:10:04 -08:00
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
Merge branch 'akpm' (patches from Andrew)
2018-02-06 22:15:42 -08:00
Merge branch 'next-seccomp' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2018-01-31 13:44:45 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching
2018-01-31 13:02:18 -08:00
smp/core: Use lockdep to assert IRQs are disabled/enabled
2017-11-08 11:13:50 +01:00
watchdog/core, powerpc: Lock cpus across reconfiguration
2017-10-04 10:53:54 +02:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
softirq: Eliminate cond_resched_rcu_qs() in favor of cond_resched()
2017-12-04 10:28:58 -08:00
fix typo in assignment of fs default overflow gid
2017-12-14 16:01:45 -06:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
pipe: reject F_SETPIPE_SZ with size over UINT_MAX
2018-02-06 18:32:47 -08:00
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
locking/barriers: Convert users of lockless_dereference() to READ_ONCE()
2017-12-17 13:57:15 +01:00
pids: introduce find_get_task_by_vpid() helper
2018-02-06 18:32:46 -08:00
kprobes: Disable the jprobes test code
2017-10-20 11:02:54 +02:00
torture: Save a line in stutter_wait(): while -> for
2017-12-11 09:18:30 -08:00
tracepoint: Remove smp_read_barrier_depends() from comment
2017-12-04 10:52:56 -08:00
kernel: make groups_sort calling a responsibility group_info allocators
2017-12-14 16:00:49 -08:00
kernel/umh.c: optimize 'proc_cap_handler()'
2017-11-17 16:10:01 -08:00
efivarfs: Limit the rate for non-root to read files
2018-02-22 10:21:02 -08:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2017-11-16 12:20:15 -08:00
Merge branch 'linus' into sched/core, to pick up fixes
2017-11-08 10:17:15 +01:00
Merge branch 'linus' into core/urgent, to pick up dependent commits
2017-11-04 08:53:04 +01:00
Staging/IIO patches for 4.16-rc1
2018-02-01 09:51:57 -08:00
Merge branch 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
2017-11-06 12:26:49 -08:00
bef3efbeb8