Date: Wed, 23 Dec 1998 12:08:43 -0800 (PST) From: Matthew Dillon <dillon@apollo.backplane.com> To: Peter Jeremy <peter.jeremy@auss2.alcatel.com.au> Cc: freebsd-security@FreeBSD.ORG Subject: Re: cvs commit: src/etc rc.conf Message-ID: <199812232008.MAA16823@apollo.backplane.com> References: <98Dec23.195410est.40360@border.alcanet.com.au>
next in thread | previous in thread | raw e-mail | index | archive | help
:>:The BSD book describes a bug in the mark and sweep garbage collection
:>:algorithm than can result in file descriptor hijacking or kernel memory
:>:nasties. Does anyone know if this was ever fixed? (It is discussed in
:>:the 4.4BSD book in a footnote on the page that discusses SCM_RIGHTS) I
:>:glanced through the code for a while this summer while I was modifying the
:>:SCM_ ancillary data passing code to be hookable by an LKM. My goal was to
:>:...
:>
:> I have no idea.... what does the footnote say exactly?
:
:At the bottom of page 389:
: "If a listening socket is accessible, then any queued connections
: that it holds are also accessible; the garbage collector in 4.4BSD
: fails to take this into account."
:
:This footnote is referenced from a paragraph discussing unp_gc() -
:which can be found in kern/uipc_usrreq.c. From a quick look at the
:2.2.6 CVS logs (the latest I can quickly study), it doesn't look like
:it's ever been eradicated.
:
:Peter
Shit. There's a bug. It took me a while to find it, but there's a
bug. A very bad bug. A Very, very, very, very bad bug. I'm going to
fix this in the FreeBSD tree first, then post the diff without
additional comment.
-Matt
Matthew Dillon Engineering, HiWay Technologies, Inc. & BEST Internet
Communications & God knows what else.
<dillon@backplane.com> (Please include original email in any response)
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199812232008.MAA16823>