Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752364AbbKYRvl (ORCPT ); Wed, 25 Nov 2015 12:51:41 -0500 Received: from mail-pa0-f42.google.com ([209.85.220.42]:36055 "EHLO mail-pa0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750832AbbKYRvd (ORCPT ); Wed, 25 Nov 2015 12:51:33 -0500 Message-ID: <1448473891.24696.21.camel@edumazet-glaptop2.roam.corp.google.com> Subject: Re: use-after-free in sock_wake_async From: Eric Dumazet To: Rainer Weikusat Cc: Eric Dumazet , Dmitry Vyukov , Benjamin LaHaise , "David S. Miller" , Hannes Frederic Sowa , Al Viro , David Howells , Ying Xue , "Eric W. Biederman" , netdev , LKML , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin Date: Wed, 25 Nov 2015 09:51:31 -0800 In-Reply-To: <87a8q23s2a.fsf@doppelsaurus.mobileactivedefense.com> References: <87poyzj7j2.fsf@doppelsaurus.mobileactivedefense.com> <87io4qevdp.fsf@doppelsaurus.mobileactivedefense.com> <87io4q3u8u.fsf@doppelsaurus.mobileactivedefense.com> <1448471494.24696.18.camel@edumazet-glaptop2.roam.corp.google.com> <87a8q23s2a.fsf@doppelsaurus.mobileactivedefense.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1117 Lines: 32 On Wed, 2015-11-25 at 17:30 +0000, Rainer Weikusat wrote: > In case this is wrong, it obviously implies that sk_sleep(sk) must not > be used anywhere as it accesses the same struck sock, hence, when that > can "suddenly" disappear despite locks are used in the way indicated > above, there is now safe way to invoke that, either, as it just does a > rcu_dereference_raw based on the assumption that the caller knows that > the i-node (and the corresponding wait queue) still exist. > Oh well. sk_sleep() is not used if the return is NULL This is exactly why we have such code in critical functions : wqueue = sk_sleep(sk); if (wqueue && waitqueue_active(wqueue)) wake_up_interruptible_poll(wqueue, POLLOUT | POLLWRNORM | POLLWRBAND); We already took care of this problem years ago, but missed the ASYNC case (that almost nobody really uses these days) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/