From: Jason Baron <jbaron@akamai•com>
To: Rainer Weikusat <rweikusat@mobileactivedefense•com>
Cc: davem@davemloft•net, netdev@vger•kernel.org,
linux-kernel@vger•kernel.org, minipli@googlemail•com,
normalperson@yhbt•net, eric.dumazet@gmail•com,
viro@zeniv•linux.org.uk, davidel@xmailserver•org,
dave@stgolabs•net, olivier@mauras•ch, pageexec@freemail•hu,
torvalds@linux-foundation•org, peterz@infradead•org
Subject: Re: [PATCH] unix: fix use-after-free with unix_dgram_poll()
Date: Fri, 02 Oct 2015 15:50:08 -0400 [thread overview]
Message-ID: <560EDFF0.9080108@akamai.com> (raw)
In-Reply-To: <871tdd3w5s.fsf@doppelsaurus.mobileactivedefense.com>
On 10/02/2015 03:30 PM, Rainer Weikusat wrote:
> Jason Baron <jbaron@akamai•com> writes:
>> From: Jason Baron <jbaron@akamai•com>
>>
>> The unix_dgram_poll() routine calls sock_poll_wait() not only for the wait
>> queue associated with the socket s that we've called poll() on, but it also
>> calls sock_poll_wait() for a remote peer socket's wait queue, if it's connected.
>> Thus, if we call poll()/select()/epoll() for the socket s, there are then
>> a couple of code paths in which the remote peer socket s2 and its associated
>> peer_wait queue can be freed before poll()/select()/epoll() have a chance
>> to remove themselves from this remote peer socket s2's wait queue.
>
> [...]
>
>> This works because we will continue to get POLLOUT wakeups from
>> unix_write_space(), which is called via sock_wfree().
>
> As pointed out in my original comment, this doesn't work (as far as I
> can/ could tell) because it will only wake up sockets which had a chance
> to enqueue datagrams to the queue of the receiving socket as only
> skbuffs enqueued there will be consumed. A socket which is really
> waiting for space in the receiving queue won't ever be woken up in this
> way.
Ok, good point. I was hoping to avoid a more complex approach here. I think
then that the patch I posted in the previous thread on this would address
this concern. I will post it for review.
>
> Further, considering that you're demonstrably not interested in
> debugging and fixing this issue (as you haven't even bothered to post
> one of the test programs you claim to have), I'm beginning to wonder why
> this tripe is being sent to me at all --- it's not "git on autopilot"
> this time as someone took the time to dig up my current e-mail address
> as the one in the original commit is not valid anymore. Could you please
> refrain from such exercises in future unless a discussion is actually
> intended?
>
>
Just trying to help fix this.
Thanks,
-Jason
next prev parent reply other threads:[~2015-10-02 19:50 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-02 19:10 [PATCH] unix: fix use-after-free with unix_dgram_poll() Jason Baron
2015-10-02 19:30 ` Rainer Weikusat
2015-10-02 19:49 ` Rainer Weikusat
2015-10-02 19:50 ` Jason Baron [this message]
2015-10-02 20:11 ` Rainer Weikusat
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=560EDFF0.9080108@akamai.com \
--to=jbaron@akamai$(echo .)com \
--cc=dave@stgolabs$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=davidel@xmailserver$(echo .)org \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=minipli@googlemail$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=normalperson@yhbt$(echo .)net \
--cc=olivier@mauras$(echo .)ch \
--cc=pageexec@freemail$(echo .)hu \
--cc=peterz@infradead$(echo .)org \
--cc=rweikusat@mobileactivedefense$(echo .)com \
--cc=torvalds@linux-foundation$(echo .)org \
--cc=viro@zeniv$(echo .)linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox