From: Philipp Hahn <pmhahn@pmhahn.de>
To: Rainer Weikusat <rweikusat@mobileactivedefense.com>,
Ben Hutchings <ben@decadent.org.uk>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>,
Sasha Levin <sasha.levin@oracle.com>,
"David S. Miller" <davem@davemloft.net>,
linux-kernel@vger.kernel.org, Karolin Seeger <kseeger@samba.org>,
Jason Baron <jbaron@akamai.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Arvid Requate <requate@univention.de>,
Stefan Gohmann <gohmann@univention.de>,
netdev@vger.kernel.org
Subject: Re: [PATCH net] af_unix: Guard against other == sk in unix_dgram_sendmsg
Date: Fri, 12 Feb 2016 10:19:36 +0100 [thread overview]
Message-ID: <56BDA3A8.6070807@pmhahn.de> (raw)
In-Reply-To: <87r3gj11jc.fsf_-_@doppelsaurus.mobileactivedefense.com>
Hello Rainer,
Am 11.02.2016 um 20:37 schrieb Rainer Weikusat:
> The unix_dgram_sendmsg routine use the following test
>
> if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
>
> to determine if sk and other are in an n:1 association (either
> established via connect or by using sendto to send messages to an
> unrelated socket identified by address). This isn't correct as the
> specified address could have been bound to the sending socket itself or
> because this socket could have been connected to itself by the time of
> the unix_peer_get but disconnected before the unix_state_lock(other). In
> both cases, the if-block would be entered despite other == sk which
> might either block the sender unintentionally or lead to trying to unlock
> the same spin lock twice for a non-blocking send. Add a other != sk
> check to guard against this.
>
> Fixes: 7d267278a9ec ("unix: avoid use-after-free in ep_remove_wait_queue")
> Reported-By: Philipp Hahn <pmhahn@pmhahn.de>
> Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>
> ---
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index 29be035..f1ca279 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -1781,7 +1781,12 @@ restart_locked:
> goto out_unlock;
> }
>
> - if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
> + /* other == sk && unix_peer(other) != sk if
> + * - unix_peer(sk) == NULL, destination address bound to sk
> + * - unix_peer(sk) == sk by time of get but disconnected before lock
> + */
> + if (other != sk &&
> + unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
> if (timeo) {
> timeo = unix_wait_for_peer(other, timeo);
>
>
After applying that patch at least my machine running the samba test no
longer crashes. So you might add
Tested-by: Philipp Hahn <pmhahn@pmhahn.de>
Thanks for looking it that issues.
Philipp
next prev parent reply other threads:[~2016-02-12 9:19 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-02 16:25 Bug 4.1.16: self-detected stall in net/unix/? Philipp Hahn
2016-02-03 1:43 ` Hannes Frederic Sowa
2016-02-05 15:28 ` Philipp Hahn
2016-02-11 13:47 ` Philipp Hahn
2016-02-11 15:55 ` Rainer Weikusat
2016-02-11 17:03 ` Ben Hutchings
2016-02-11 17:40 ` Rainer Weikusat
2016-02-11 17:54 ` Rainer Weikusat
2016-02-11 18:31 ` Rainer Weikusat
2016-02-11 19:37 ` [PATCH net] af_unix: Guard against other == sk in unix_dgram_sendmsg Rainer Weikusat
2016-02-12 9:19 ` Philipp Hahn [this message]
2016-02-12 13:25 ` Rainer Weikusat
2016-02-12 19:54 ` Ben Hutchings
2016-02-12 20:17 ` Rainer Weikusat
2016-02-12 20:47 ` Ben Hutchings
2016-02-12 20:59 ` Rainer Weikusat
2016-02-16 17:54 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56BDA3A8.6070807@pmhahn.de \
--to=pmhahn@pmhahn.de \
--cc=ben@decadent.org.uk \
--cc=davem@davemloft.net \
--cc=gohmann@univention.de \
--cc=gregkh@linuxfoundation.org \
--cc=hannes@stressinduktion.org \
--cc=jbaron@akamai.com \
--cc=kseeger@samba.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=requate@univention.de \
--cc=rweikusat@mobileactivedefense.com \
--cc=sasha.levin@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).