Skip to content

do_socketpair possible bug when fd table is full #1172

Description

@scaspin

Similarly to #1171, the raw_descriptor_store lock is grabbed three times in succession for two inserts. If the second operation fails (because the table is full, for example) the first fd is removed. If a concurrent thread interleaves between these two lock acquisitions and closes the same slot, the second insert's failure mode will either try to close a non-existent fd or an unrelated fd.

let raw_fd1 = files.insert_raw_fd(typed1).map_err(|typed| {
let _ = self.global.litebox.descriptor_table_mut().remove(&typed);
Errno::EMFILE
})?;
let raw_fd2 = files.insert_raw_fd(typed2).map_err(|typed| {
self.do_close(raw_fd1).unwrap();
let _ = self.global.litebox.descriptor_table_mut().remove(&typed);
Errno::EMFILE
})?;

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions