From: Eric Dumazet <eric.dumazet@gmail.com>
To: Shan Wei <shanwei@cn.fujitsu.com>
Cc: "Марк Коренберг" <socketpair@gmail.com>,
"David Miller" <davem@davemloft.net>,
netdev@vger.kernel.org
Subject: Re: Fwd: Simple kernel attack using socketpair. easy, 100% reproductiblle, works under guest. no way to protect :(
Date: Fri, 26 Nov 2010 09:22:28 +0100 [thread overview]
Message-ID: <1290759748.2855.4.camel@edumazet-laptop> (raw)
In-Reply-To: <4CEF64A4.5080802@cn.fujitsu.com>
Le vendredi 26 novembre 2010 à 15:41 +0800, Shan Wei a écrit :
> Eric Dumazet wrote, at 11/25/2010 10:11 PM:
> > @@ -1845,6 +1871,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
> > unix_state_lock(sk);
> > skb = skb_dequeue(&sk->sk_receive_queue);
> > if (skb == NULL) {
> > + unix_sk(sk)->recursion_level = 0;
>
> For SOCK_SEQPACKET type, no need to clear recursion_level counter?
>
>
There is no need actually to clear it at all.
If an application has a complex setup with a dependence tree of unix
sockets, it will break if messages are not read fast enough.
So, maybe I should remove this line so that underlying problem comes
into surface immediately, rather than while in stress load.
next prev parent reply other threads:[~2010-11-26 8:22 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <AANLkTikCeddPFRGojPGuB6oq3xGYgovtm8r4=WhjEDpe@mail.gmail.com>
2010-11-25 6:28 ` Simple kernel attack using socketpair. easy, 100% reproductiblle, works under guest. no way to protect :( Eric Dumazet
2010-11-25 6:52 ` Марк Коренберг
[not found] ` <1290668246.2798.93.camel@edumazet-laptop>
[not found] ` <AANLkTinQa8BCH-k0m=ndu4u8L-kCiD00jYjKvsvoxK2E@mail.gmail.com>
2010-11-25 7:52 ` Fwd: " Марк Коренберг
2010-11-25 8:16 ` Eric Dumazet
2010-11-25 8:35 ` Марк Коренберг
2010-11-25 14:11 ` Eric Dumazet
2010-11-26 4:38 ` Shan Wei
2010-11-26 6:23 ` Eric Dumazet
2010-11-26 7:52 ` Shan Wei
2010-11-26 7:41 ` Shan Wei
2010-11-26 8:22 ` Eric Dumazet [this message]
2010-11-26 8:59 ` Eric Dumazet
2010-11-29 17:46 ` David Miller
2010-11-29 18:01 ` Eric Dumazet
[not found] ` <AANLkTinRhmiVoVR5ibWOKe-OhY4fYUs_PHSATjxMGqg9@mail.gmail.com>
[not found] ` <1290670889.2798.127.camel@edumazet-laptop>
2010-11-25 8:05 ` Марк Коренберг
2010-11-25 7:14 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1290759748.2855.4.camel@edumazet-laptop \
--to=eric.dumazet@gmail.com \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=shanwei@cn.fujitsu.com \
--cc=socketpair@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox