lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Tue, 05 Jun 2007 00:02:47 -0700 (PDT)
From:	David Miller <>
Subject: Re: [PATCH] fix race in AF_UNIX

From: Miklos Szeredi <>
Date: Mon, 04 Jun 2007 11:45:32 +0200

> > A recv() on an AF_UNIX, SOCK_STREAM socket can race with a
> > send()+close() on the peer, causing recv() to return zero, even though
> > the sent data should be received.
> > 
> > This happens if the send() and the close() is performed between
> > skb_dequeue() and checking sk->sk_shutdown in unix_stream_recvmsg():
> > 
> > process A  skb_dequeue() returns NULL, there's no data in the socket queue
> > process B  new data is inserted onto the queue by unix_stream_sendmsg()
> > process B  sk->sk_shutdown is set to SHUTDOWN_MASK by unix_release_sock()
> > process A  sk->sk_shutdown is checked, unix_release_sock() returns zero
> This is only part of the story.  It turns out, there are other races
> involving the garbage collector, that can throw away perfectly good
> packets with AF_UNIX sockets in them.
> The problems arise when a socket goes from installed to in-flight or
> vica versa during garbage collection.  Since gc is done with a
> spinlock held, this only shows up on SMP.
> The following patch fixes it for me, but it's possibly the wrong
> approach.
> Signed-off-by: Miklos Szeredi <>

I haven't seen a repost of the first patch, which is necessary because
that first patch doesn't apply to the current tree.  Please don't
ignore Arnaldo's feedback like that, or else I'll ignore you just the
same. :-)

To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists