Messages in this thread | | | Date | Tue, 24 Nov 2015 14:12:35 -0800 | Subject | Re: use-after-free in sock_wake_async | From | Eric Dumazet <> |
| |
On Tue, Nov 24, 2015 at 2:03 PM, Eric Dumazet <edumazet@google.com> wrote:
> > This might be a data race in sk_wake_async() if inlined by compiler > (see https://lkml.org/lkml/2015/11/24/680 for another example) > > KASAN adds register pressure and compiler can then do 'stupid' things :( > > diff --git a/include/net/sock.h b/include/net/sock.h > index 7f89e4ba18d1..2af6222ccc67 100644 > --- a/include/net/sock.h > +++ b/include/net/sock.h > @@ -2008,7 +2008,7 @@ static inline unsigned long sock_wspace(struct sock *sk) > static inline void sk_wake_async(struct sock *sk, int how, int band) > { > if (sock_flag(sk, SOCK_FASYNC)) > - sock_wake_async(sk->sk_socket, how, band); > + sock_wake_async(READ_ONCE(sk->sk_socket), how, band); > } > > /* Since sk_{r,w}mem_alloc sums skb->truesize, even a small frame might
Oh well, sock_wake_async() can not be inlined, scratch this.
| |