From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751652AbbJEQyi (ORCPT ); Mon, 5 Oct 2015 12:54:38 -0400 Received: from mail-pa0-f67.google.com ([209.85.220.67]:32803 "EHLO mail-pa0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751139AbbJEQyg (ORCPT ); Mon, 5 Oct 2015 12:54:36 -0400 Message-ID: <1444064074.9555.4.camel@edumazet-glaptop2.roam.corp.google.com> Subject: Re: [PATCH v2 1/3] unix: fix use-after-free in unix_dgram_poll() From: Eric Dumazet To: Rainer Weikusat Cc: Jason Baron , davem@davemloft.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, minipli@googlemail.com, normalperson@yhbt.net, viro@zeniv.linux.org.uk, davidel@xmailserver.org, dave@stgolabs.net, olivier@mauras.ch, pageexec@freemail.hu, torvalds@linux-foundation.org, peterz@infradead.org Date: Mon, 05 Oct 2015 09:54:34 -0700 In-Reply-To: <87bncdxool.fsf@doppelsaurus.mobileactivedefense.com> References: <87bncdxool.fsf@doppelsaurus.mobileactivedefense.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 2015-10-05 at 17:31 +0100, Rainer Weikusat wrote: > atomic_long_set(&u->inflight, 0); > INIT_LIST_HEAD(&u->link); > @@ -2135,8 +2139,16 @@ static unsigned int unix_poll(struct fil > static unsigned int unix_dgram_poll(struct file *file, struct socket *sock, > poll_table *wait) > { > - struct sock *sk = sock->sk, *other; > - unsigned int mask, writable; > + struct sock *sk = sock->sk, *other, *pp; > + struct unix_sock *u; > + unsigned int mask, writable, dead; > + > + u = unix_sk(sk); > + pp = u->poll_peer; > + if (pp) { > + u->poll_peer = NULL; > + sock_put(pp); > + } This looks racy. Multiple threads could use poll() at the same time, and you would have too many sock_put()