Subject: Re: [PATCH -next v2] unix stream: Fix use-after-free crashes

From: Jiri Slaby <[email-masked]>
Date: Thu, 08 Sep 2011 09:56:01 +0200

On 09/08/2011 09:11 AM, Eric Dumazet wrote:
> Le jeudi 08 septembre 2011 à 14:22 +0800, Yan, Zheng a écrit :
> 
>> I don't think so. unix_scm_to_skb() calls unix_attach_fds(), it
>> always duplicates scm->fp. 
> 
> What a mess. This code is a nightmare.
> 
> Part of the mess comes from scm_destroy() and scm_release() duplication.
> 
> We should have scm_destroy() only, as before, and NULLify scm->pid/cred
> in unix_scm_to_skb() when we steal references.

This patch works for me. I haven't tried the out_err fixup from the
followup, but I assume I won't spot a difference as those are fail paths
anyway...

thanks,
-- 
js