From owner-freebsd-security Wed Dec 23 12:08:55 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id MAA01251 for freebsd-security-outgoing; Wed, 23 Dec 1998 12:08:55 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from apollo.backplane.com (apollo.backplane.com [209.157.86.2]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id MAA01246 for ; Wed, 23 Dec 1998 12:08:53 -0800 (PST) (envelope-from dillon@apollo.backplane.com) Received: (from dillon@localhost) by apollo.backplane.com (8.9.1/8.9.1) id MAA16823; Wed, 23 Dec 1998 12:08:43 -0800 (PST) (envelope-from dillon) Date: Wed, 23 Dec 1998 12:08:43 -0800 (PST) From: Matthew Dillon Message-Id: <199812232008.MAA16823@apollo.backplane.com> To: Peter Jeremy Cc: freebsd-security@FreeBSD.ORG Subject: Re: cvs commit: src/etc rc.conf References: <98Dec23.195410est.40360@border.alcanet.com.au> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org :>:The BSD book describes a bug in the mark and sweep garbage collection :>:algorithm than can result in file descriptor hijacking or kernel memory :>:nasties. Does anyone know if this was ever fixed? (It is discussed in :>:the 4.4BSD book in a footnote on the page that discusses SCM_RIGHTS) I :>:glanced through the code for a while this summer while I was modifying the :>:SCM_ ancillary data passing code to be hookable by an LKM. My goal was to :>:... :> :> I have no idea.... what does the footnote say exactly? : :At the bottom of page 389: : "If a listening socket is accessible, then any queued connections : that it holds are also accessible; the garbage collector in 4.4BSD : fails to take this into account." : :This footnote is referenced from a paragraph discussing unp_gc() - :which can be found in kern/uipc_usrreq.c. From a quick look at the :2.2.6 CVS logs (the latest I can quickly study), it doesn't look like :it's ever been eradicated. : :Peter Shit. There's a bug. It took me a while to find it, but there's a bug. A very bad bug. A Very, very, very, very bad bug. I'm going to fix this in the FreeBSD tree first, then post the diff without additional comment. -Matt Matthew Dillon Engineering, HiWay Technologies, Inc. & BEST Internet Communications & God knows what else. (Please include original email in any response) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message