Re: Security critical race condition in epoll code

From: Davide Libenzi (davidel@xmailserver.org)
Date: Mon Oct 28 2002 - 21:13:10 EST


On Mon, 28 Oct 2002, John Gardiner Myers wrote:

> First a user space program creates an epoll fd and adds a socket to it
> using sys_epoll_ctl(...EP_CTL_ADD...)
>
> Then the program creates two threads, A and B. Simultaneously, A calls
> sys_epoll_ctl(...EP_CTL_MOD...) and B calls
> sys_epoll_ctl(...EP_CTL_DEL...) on the socket that was previously added.
>
> Thread A runs up through the point where ep_find() returns the (struct
> epitem *) for the socket.
>
> Thread B then runs and ep_remove() frees the (struct epitem *).
>
> Thread A then runs some more and stores the value of events into the now
> freed block of memory pointed to by dpi.

Ugh ... I forgot that you're the one that is handling an fd with 25000
threads :) This is true and it'll be fixed before you can read this
message ...

- Davide

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Thu Oct 31 2002 - 22:00:41 EST