Hacker News Reader

Comment by wofo | Hacker News Reader

Could you elaborate on io_uring being a security disaster? The Redox article has the following to say:

> In its early days, io_uring did have a few security issues and memory leaks, but these have since been addressed

The article also links to a GitHub discussion where someone explains how io_uring is actually all right (see https://github.com/axboe/liburing/discussions/1047#discussio... ).

(I don't have a horse in this race, I just like being well informed and had reconciled myself with io_uring being secure as a consequence of the Redox article.)

View on HN

The Redox article is underselling it somewhat. Part of the problem is Linux's historical syscall restriction systems (seccomp) did not (does not?) apply to io_uring, so io_uring is (was?) all or nothing on async versions of syscalls it implements. Also, io_uring is rapidly adding API surface compared to other parts of the kernel. With these factors combined, it has had repeated security problems since 2019 and has lead to, e.g., Android disabling io_uring entirely for applications.

https://security.googleblog.com/2023/06/learnings-from-kctf-...

> in the past year, there has been a clear trend: 60% of the submissions exploited the io_uring component of the Linux kernel (we paid out around 1 million USD for io_uring alone). Furthermore, io_uring vulnerabilities were used in all the submissions which bypassed our mitigations.

More like io_urine, it leaks everywhere and if pisses you off in both ways. Even more by hooking it up against DMABUF. We didn't learn anything from the 90's...

7.0 added task level filtering using regular bpf filters.

https://lwn.net/Articles/1054225

Great!

I would think that Android applications also don't really benefit from uring anyway since human-facing applications tend to not actually do all that much. Like for networking, they're not trying to process millions of connections/flows at 10s of Gbit/s. They'd be processing 1-20 flows at like a few Mbit/s. The types of processes that might benefit tend to also be relatively controlled (e.g. a database or application server).

In the abstract there's nothing necessarily inherently insecure about io_uring. In practice on Linux it's a security disaster because it hooks into and interacts with subsystems in ways never anticipated when they were originally written, exposing and creating all kinds of bugs. Claims that the wave of bugs is now in the past were... premature. They haven't really stopped, though part of that is because io_uring hasn't stopped growing and becoming more complex itself.

Reply on news.ycombinator.com