OpenVZ Forum


Home » Mailing lists » Devel » [PATCH 0/4] Fix race between sk_filter reassign and sk_clone()
[PATCH 0/4] Fix race between sk_filter reassign and sk_clone() [message #21864] Wed, 17 October 2007 09:45 Go to previous message
Pavel Emelianov is currently offline  Pavel Emelianov
Messages: 1149
Registered: September 2006
Senior Member
The race can result in that some sock will get an sk_filter
pointer set to kfree-d memory. Look

CPU1:                            CPU2:
sk_clone():                      sk_attach_filter():
  new_sk = sk_alloc(...);
  sock_copy(new_sk, sk); 
  /* copies the filter ptr */
  ...
  filter = new_sk->sk_filter;
  if (filter)
                                     old_fp = sk->sk_filter;
                                     ...
                                     sk_filter_release(old_fp);
                                       if (atomic_dec_and_test(&old_fp->refcnt))
     atomic_inc(&filter->refcnt);
                                          /* true */
                                          call_rcu(&fp->rcu, kfree);

that's it - after a quiescent state pass the new_sk will have 
a pointer on kfree-d filter.

The same problem exists for detaching filter (SO_DETACH_FILTER).

The proposed fix consists of 3 preparation patches and the fix itself.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
 
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Previous Topic: How Inactive may be much greather than cached?
Next Topic: Re: 2.6.23-mm1 s390 driver problem
Goto Forum:
  


Current Time: Thu Jul 18 02:34:15 GMT 2024

Total time taken to generate the page: 0.02619 seconds