Skip to content

do_socketpair possible bug when fd table is full #1172

Description

@scaspin

Similarly to #1171, the raw_descriptor_store lock is grabbed three times in succession for two inserts. If the second operation fails (because the table is full, for example) the first fd is removed. If a concurrent thread interleaves between these two lock acquisitions and closes the same slot, the second insert's failure mode will either try to close a non-existent fd or an unrelated fd.

let raw_fd1 = files.insert_raw_fd(typed1).map_err(|typed| {
let _ = self.global.litebox.descriptor_table_mut().remove(&typed);
Errno::EMFILE
})?;
let raw_fd2 = files.insert_raw_fd(typed2).map_err(|typed| {
self.do_close(raw_fd1).unwrap();
let _ = self.global.litebox.descriptor_table_mut().remove(&typed);
Errno::EMFILE
})?;

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions