Re: [PATCH] unix: avoid use-after-free in ep_remove_wait_queue (w/ Fixes:)

[Jason Baron]

On 11/19/2015 06:52 PM, Rainer Weikusat wrote:

[...]

> @@ -1590,21 +1718,35 @@ restart:
>  			goto out_unlock;
>  	}
>  
> -	if (unix_peer(other) != sk && unix_recvq_full(other)) {
> -		if (!timeo) {
> +	if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
> +		if (timeo) {
> +			timeo = unix_wait_for_peer(other, timeo);
> +
> +			err = sock_intr_errno(timeo);
> +			if (signal_pending(current))
> +				goto out_free;
> +
> +			goto restart;
> +		}
> +
> +		if (unix_peer(sk) != other ||
> +		    unix_dgram_peer_wake_me(sk, other)) {
>  			err = -EAGAIN;
>  			goto out_unlock;
>  		}

Hi,

So here we are calling unix_dgram_peer_wake_me() without the sk lock the first time
through - right? In that case, we can end up registering on the queue of other for
the callback but we might have already connected to a different remote. In that case,
the wakeup will crash if 'sk' has freed in the meantime.

Thanks,

-Jason

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/