]> git.baikalelectronics.ru Git - kernel.git/commit
unix: properly account for FDs passed over unix sockets
authorwilly tarreau <w@1wt.eu>
Sun, 10 Jan 2016 06:54:56 +0000 (07:54 +0100)
committerDavid S. Miller <davem@davemloft.net>
Mon, 11 Jan 2016 05:05:30 +0000 (00:05 -0500)
commitf625c8daa0d6e4e2220a9795d4adb5c7e2fccc2a
treeee2f45594b6acfc83a69988a914b9fe15d6e4367
parentfb3dedc47bf92e1011e5908d4330f9b7c4d461d8
unix: properly account for FDs passed over unix sockets

It is possible for a process to allocate and accumulate far more FDs than
the process' limit by sending them over a unix socket then closing them
to keep the process' fd count low.

This change addresses this problem by keeping track of the number of FDs
in flight per user and preventing non-privileged processes from having
more FDs in flight than their configured FD limit.

Reported-by: socketpair@gmail.com
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/sched.h
net/unix/af_unix.c
net/unix/garbage.c