Re: [patch] af_unix fix for a panic a DoS and a memory leak [Re:

Andrea Arcangeli (andrea@e-mind.com)
Thu, 4 Mar 1999 12:24:56 +0100 (CET)


On Wed, 3 Mar 1999, Andrea Arcangeli wrote:

>On Wed, 3 Mar 1999 kuznet@ms2.inr.ac.ru wrote:
>
>>and wake_up_interruptible(&unix_global_ack_queue) on all --ack_backlog
>
>We must wake_up_interruptible only when ack_backlog == max_ack_backlog,
>and always when we close a listening socket.
>
>Here a new patch against 2.2.2:

Woops I noticed now I did some mistakes in the last big patch (I need to
sleep one night to understand these things ;). Here an incremental patch
that fix my mistakes:

Index: net/unix//af_unix.c
===================================================================
RCS file: /var/cvs/linux/net/unix/af_unix.c,v
retrieving revision 1.1.2.7
diff -u -r1.1.2.7 af_unix.c
--- af_unix.c 1999/03/03 21:37:42 1.1.2.7
+++ linux/net/unix/af_unix.c 1999/03/04 11:18:28
@@ -711,11 +711,9 @@
return -ECONNREFUSED;

while (other->ack_backlog >= other->max_ack_backlog) {
+ unix_unlock(other);
if (other->dead || other->state != TCP_LISTEN)
- {
- unix_unlock(other);
return -ECONNREFUSED;
- }
if (flags & O_NONBLOCK)
return -EAGAIN;
interruptible_sleep_on(&unix_ack_wqueue);
@@ -1024,6 +1022,16 @@
interruptible_sleep_on(&unix_dgram_wqueue);
if (other->dead)
goto dead;
+ if (sk->shutdown & SEND_SHUTDOWN)
+ {
+ err = -EPIPE;
+ goto out_unlock;
+ }
+ if (signal_pending(current))
+ {
+ err = -ERESTARTSYS;
+ goto out_unlock;
+ }
}

skb_queue_tail(&other->receive_queue, skb);

Does it make sense to return -EPIPE if it's been requested a send shutdown
even if we are a dgram socks?

Andrea Arcangeli

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/