Messages in this thread | | | Subject | Re: [PATCH v2 1/3] unix: fix use-after-free in unix_dgram_poll() | From | Eric Dumazet <> | Date | Mon, 05 Oct 2015 09:54:34 -0700 |
| |
On Mon, 2015-10-05 at 17:31 +0100, Rainer Weikusat wrote:
> atomic_long_set(&u->inflight, 0); > INIT_LIST_HEAD(&u->link); > @@ -2135,8 +2139,16 @@ static unsigned int unix_poll(struct fil > static unsigned int unix_dgram_poll(struct file *file, struct socket *sock, > poll_table *wait) > { > - struct sock *sk = sock->sk, *other; > - unsigned int mask, writable; > + struct sock *sk = sock->sk, *other, *pp; > + struct unix_sock *u; > + unsigned int mask, writable, dead; > + > + u = unix_sk(sk); > + pp = u->poll_peer; > + if (pp) { > + u->poll_peer = NULL; > + sock_put(pp); > + }
This looks racy. Multiple threads could use poll() at the same time, and you would have too many sock_put()
| |