Re: [PATCH] unix: avoid use-after-free in ep_remove_wait_queue (w/ Fixes:)
From: Rainer Weikusat <hidden>
Date: 2015-11-17 22:09:40
Also in:
linux-fsdevel, lkml
From: Rainer Weikusat <hidden>
Date: 2015-11-17 22:09:40
Also in:
linux-fsdevel, lkml
Rainer Weikusat [off-list ref] writes: [...]
The basic options would be
- return EAGAIN even if sending became possible (Jason's most
recent suggestions)
- retry sending a limited number of times, eg, once, before
returning EAGAIN, on the grounds that this is nicer to the
application and that redoing all the stuff up to the _lock in
dgram_sendmsg can possibly/ likely be avoided
A third option: Use trylock to acquire the sk lock. If this succeeds,
there's no risk of deadlocking anyone even if acquiring the locks in the
wrong order. This could look as follows (NB: I didn't even compile this,
I just wrote the code to get an idea how complicated it would be):
int need_wakeup;
[...]
need_wakeup = 0;
err = 0;
if (spin_lock_trylock(unix_sk(sk)->lock)) {
if (unix_peer(sk) != other ||
unix_dgram_peer_wake_me(sk, other))
err = -EAGAIN;
} else {
err = -EAGAIN;
unix_state_unlock(other);
unix_state_lock(sk);
need_wakeup = unix_peer(sk) != other &&
unix_dgram_peer_wake_connect(sk, other) &&
sk_receive_queue_len(other) == 0;
}
unix_state_unlock(sk);
if (err) {
if (need_wakeup)
wake_up_interruptible_poll(sk_sleep(sk),
POLLOUT |
POLLWRNORM |
POLLWRBAND);
goto out_free;
}