lkml.org 
[lkml]   [2015]   [Oct]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v2 1/3] unix: fix use-after-free in unix_dgram_poll()
    From
    Date
    On Mon, 2015-10-05 at 17:31 +0100, Rainer Weikusat wrote:

    > atomic_long_set(&u->inflight, 0);
    > INIT_LIST_HEAD(&u->link);
    > @@ -2135,8 +2139,16 @@ static unsigned int unix_poll(struct fil
    > static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
    > poll_table *wait)
    > {
    > - struct sock *sk = sock->sk, *other;
    > - unsigned int mask, writable;
    > + struct sock *sk = sock->sk, *other, *pp;
    > + struct unix_sock *u;
    > + unsigned int mask, writable, dead;
    > +
    > + u = unix_sk(sk);
    > + pp = u->poll_peer;
    > + if (pp) {
    > + u->poll_peer = NULL;
    > + sock_put(pp);
    > + }


    This looks racy.
    Multiple threads could use poll() at the same time,
    and you would have too many sock_put()





    \
     
     \ /
      Last update: 2015-10-05 19:21    [W:4.687 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site