Re: Reported regression against commit a05d2ad

[ebiederm@xmission.com (Eric W. Biederman)]

Tim Gardner <tim.gardner@canonical.com> writes:

> On 06/21/2011 02:49 PM, Eric W. Biederman wrote:
> <snip>
>> I respectfully suggest that the bug is elsewhere perhaps a broken user
>> space application out there that needs to be fixed, or you have a kernel
>> memory stomp that removing patch a05d2ad happens to shift the memory
>> layout to be harmful in a different way.
>>
>
> OK, I'm remembering how PF_UNIX Unix domain sockets are used, so I think your
> theory about a misbehaving user space application is more likely. However, I am
> a bit confused about how an application can attempt to receive before the socket
> is fully opened. Some kind of race condition with socketpair() ?

The case that is relevant is a listening SOCK_SEQPACKET socket.

The case that is affected is when you call receive on a listening
socket.

It isn't that the socket isn't fully opened.  It is that accept is the
only legitimate operation at that point.

It took a mistake while someone was developing an application for this
kernel bug to be found.

Eric