summaryrefslogtreecommitdiffhomepage
path: root/pkg/sentry/memmap
diff options
context:
space:
mode:
authorAyush Ranjan <ayushranjan@google.com>2020-12-15 15:25:35 -0800
committergVisor bot <gvisor-bot@google.com>2020-12-15 15:27:35 -0800
commitf6407de6bafbf8fe3e4579c876640672380fa96c (patch)
tree313172f5a4285887629379df898f09fcda65919a /pkg/sentry/memmap
parentcc28d36845cd3b2267ececbdf81b2c265267cdec (diff)
[syzkaller] Avoid AIOContext from resurrecting after being marked dead.
syzkaller reported the closing of a nil channel. This is only possible when the AIOContext was destroyed twice. Some scenarios that could lead to this: - It died and then some called aioCtx.Prepare() on it and then killed it again which could cause the double destroy. The context could have been destroyed in between the call to LookupAIOContext() and Prepare(). - aioManager was destroyed but it did not update the contexts map. So Lookup could still return a dead AIOContext and then someone could call Prepare on it and kill it again. So added a check in aioCtx.Prepare() for the context being dead. This will prevent a dead context from resurrecting. Also refactored code to destroy the aioContext consistently. Earlier we were not munmapping the aioContexts that were destroyed upon aioManager destruction. Reported-by: syzbot+ef6a588d0ce6059991d2@syzkaller.appspotmail.com PiperOrigin-RevId: 347704347
Diffstat (limited to 'pkg/sentry/memmap')
0 files changed, 0 insertions, 0 deletions