Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-15 Thread David Miller
From: Hannes Frederic Sowa Date: Tue, 10 Nov 2015 16:23:15 +0100 > During splicing an af-unix socket to a pipe we have to drop all > af-unix socket locks. While doing so we allow another reader to enter > unix_stream_read_generic which can read, copy and finally free another > skb. If exactly thi

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Hannes Frederic Sowa
On Wed, Nov 11, 2015, at 21:09, Eric Dumazet wrote: > On Wed, 2015-11-11 at 20:58 +0100, Hannes Frederic Sowa wrote: > > > > On Wed, Nov 11, 2015, at 20:42, Eric Dumazet wrote: > > > On Wed, 2015-11-11 at 20:35 +0100, Hannes Frederic Sowa wrote: > > > > > > > > On Wed, Nov 11, 2015, at 20:28, Er

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Eric Dumazet
On Wed, 2015-11-11 at 20:58 +0100, Hannes Frederic Sowa wrote: > > On Wed, Nov 11, 2015, at 20:42, Eric Dumazet wrote: > > On Wed, 2015-11-11 at 20:35 +0100, Hannes Frederic Sowa wrote: > > > > > > On Wed, Nov 11, 2015, at 20:28, Eric Dumazet wrote: > > > > On Wed, 2015-11-11 at 20:14 +0100, Hann

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Hannes Frederic Sowa
On Wed, Nov 11, 2015, at 20:42, Eric Dumazet wrote: > On Wed, 2015-11-11 at 20:35 +0100, Hannes Frederic Sowa wrote: > > > > On Wed, Nov 11, 2015, at 20:28, Eric Dumazet wrote: > > > On Wed, 2015-11-11 at 20:14 +0100, Hannes Frederic Sowa wrote: > > > > On Wed, Nov 11, 2015, at 19:58, Eric Dumaz

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Eric Dumazet
On Wed, 2015-11-11 at 20:35 +0100, Hannes Frederic Sowa wrote: > > On Wed, Nov 11, 2015, at 20:28, Eric Dumazet wrote: > > On Wed, 2015-11-11 at 20:14 +0100, Hannes Frederic Sowa wrote: > > > On Wed, Nov 11, 2015, at 19:58, Eric Dumazet wrote: > > > > > Can you elaborate? > > > > > > I use tail

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Hannes Frederic Sowa
On Wed, Nov 11, 2015, at 20:28, Eric Dumazet wrote: > On Wed, 2015-11-11 at 20:14 +0100, Hannes Frederic Sowa wrote: > > On Wed, Nov 11, 2015, at 19:58, Eric Dumazet wrote: > > > Can you elaborate? > > > > I use tail as a cookie and check if we already tried to append to the > > same tail skb w

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Eric Dumazet
On Wed, 2015-11-11 at 20:14 +0100, Hannes Frederic Sowa wrote: > On Wed, Nov 11, 2015, at 19:58, Eric Dumazet wrote: > Can you elaborate? > > I use tail as a cookie and check if we already tried to append to the > same tail skb with skb_append_pagefrags. If during allocation, which we > do outsid

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Hannes Frederic Sowa
On Wed, Nov 11, 2015, at 20:14, Hannes Frederic Sowa wrote: > On Wed, Nov 11, 2015, at 19:58, Eric Dumazet wrote: > > On Tue, 2015-11-10 at 16:23 +0100, Hannes Frederic Sowa wrote: > > > During splicing an af-unix socket to a pipe we have to drop all > > > af-unix socket locks. While doing so we al

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Hannes Frederic Sowa
On Wed, Nov 11, 2015, at 19:58, Eric Dumazet wrote: > On Tue, 2015-11-10 at 16:23 +0100, Hannes Frederic Sowa wrote: > > During splicing an af-unix socket to a pipe we have to drop all > > af-unix socket locks. While doing so we allow another reader to enter > > unix_stream_read_generic which can r

Re: [PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-11 Thread Eric Dumazet
On Tue, 2015-11-10 at 16:23 +0100, Hannes Frederic Sowa wrote: > During splicing an af-unix socket to a pipe we have to drop all > af-unix socket locks. While doing so we allow another reader to enter > unix_stream_read_generic which can read, copy and finally free another > skb. If exactly this sk

[PATCH net v3] af-unix: fix use-after-free with concurrent readers while splicing

2015-11-10 Thread Hannes Frederic Sowa
During splicing an af-unix socket to a pipe we have to drop all af-unix socket locks. While doing so we allow another reader to enter unix_stream_read_generic which can read, copy and finally free another skb. If exactly this skb is just in process of being spliced we get a use-after-free report by