Messages in this thread | | | Subject | Re: [PATCH] unix: avoid use-after-free in ep_remove_wait_queue (w/ Fixes:) | From | Jason Baron <> | Date | Fri, 20 Nov 2015 11:03:36 -0500 |
| |
On 11/19/2015 06:52 PM, Rainer Weikusat wrote:
[...]
> @@ -1590,21 +1718,35 @@ restart: > goto out_unlock; > } > > - if (unix_peer(other) != sk && unix_recvq_full(other)) { > - if (!timeo) { > + if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { > + if (timeo) { > + timeo = unix_wait_for_peer(other, timeo); > + > + err = sock_intr_errno(timeo); > + if (signal_pending(current)) > + goto out_free; > + > + goto restart; > + } > + > + if (unix_peer(sk) != other || > + unix_dgram_peer_wake_me(sk, other)) { > err = -EAGAIN; > goto out_unlock; > }
Hi,
So here we are calling unix_dgram_peer_wake_me() without the sk lock the first time through - right? In that case, we can end up registering on the queue of other for the callback but we might have already connected to a different remote. In that case, the wakeup will crash if 'sk' has freed in the meantime.
Thanks,
-Jason
| |