Re: Fix for the fundamental network/block layer race in sendfile().

[Eric Dumazet <dada1@cosmosbay.com>]

Evgeniy Polyakov a écrit :
> On Tue, Apr 01, 2008 at 09:21:19PM +0200, Eric Dumazet (dada1@cosmosbay.com) wrote:
>> I see no socket locking, so multiple threads could use sendfile() & 
>> sendmsg() on same socket, and crash kernel...
> 
> How?
> Those who use sendfile() automatically install page->lru.prev which is
> checked in release path, only those with given value will be processed
> as spliced (i.e. new callback).
> 
> It is safe to install new callback on skbs which were not spliced, since
> for that skbs it will be pure sock_wfree().
> 

first thread is doing its sendfile, and clears the bit while second thread

just entered sendfile() too, just after setting the bit and calling

do_splice_direct()

skb_set_owner_w() see the bit cleared, so install normal sock_wfree destructor 
instead of sh_user_data.

crash or leak god_bless_us, you chose :)