diff options
| author | willy tarreau <w@1wt.eu> | 2016-01-10 07:54:56 +0100 |
|---|---|---|
| committer | Luis Henriques <luis.henriques@canonical.com> | 2016-01-28 10:23:38 +0000 |
| commit | 660f0e9358bc1a8e05a2675f4320935ad5c249bf (patch) | |
| tree | 16866f5597875378fb93afbc0b2c0ba9ac04de7f /include/linux | |
| parent | c6ebbea289e909e6e65c5050a2bb74c64748b65d (diff) | |
unix: properly account for FDs passed over unix sockets
commit 712f4aad406bb1ed67f3f98d04c044191f0ff593 upstream.
It is possible for a process to allocate and accumulate far more FDs than
the process' limit by sending them over a unix socket then closing them
to keep the process' fd count low.
This change addresses this problem by keeping track of the number of FDs
in flight per user and preventing non-privileged processes from having
more FDs in flight than their configured FD limit.
Reported-by: socketpair@gmail.com
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/sched.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/sched.h b/include/linux/sched.h index a632aaad1e59..767da1f3c5df 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -763,6 +763,7 @@ struct user_struct { unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */ #endif unsigned long locked_shm; /* How many pages of mlocked shm ? */ + unsigned long unix_inflight; /* How many files in flight in unix sockets */ #ifdef CONFIG_KEYS struct key *uid_keyring; /* UID specific keyring */ |