diff options
| author | Ayush Ranjan <ayushranjan@google.com> | 2020-12-15 15:25:35 -0800 |
|---|---|---|
| committer | gVisor bot <gvisor-bot@google.com> | 2020-12-15 15:27:35 -0800 |
| commit | f6407de6bafbf8fe3e4579c876640672380fa96c (patch) | |
| tree | 313172f5a4285887629379df898f09fcda65919a /pkg/sentry/mm/shm.go | |
| parent | cc28d36845cd3b2267ececbdf81b2c265267cdec (diff) | |
[syzkaller] Avoid AIOContext from resurrecting after being marked dead.
syzkaller reported the closing of a nil channel. This is only possible when the
AIOContext was destroyed twice.
Some scenarios that could lead to this:
- It died and then some called aioCtx.Prepare() on it and then killed it again
which could cause the double destroy. The context could have been destroyed
in between the call to LookupAIOContext() and Prepare().
- aioManager was destroyed but it did not update the contexts map. So
Lookup could still return a dead AIOContext and then someone could call
Prepare on it and kill it again.
So added a check in aioCtx.Prepare() for the context being dead. This will
prevent a dead context from resurrecting.
Also refactored code to destroy the aioContext consistently. Earlier we were not
munmapping the aioContexts that were destroyed upon aioManager destruction.
Reported-by: syzbot+ef6a588d0ce6059991d2@syzkaller.appspotmail.com
PiperOrigin-RevId: 347704347
Diffstat (limited to 'pkg/sentry/mm/shm.go')
0 files changed, 0 insertions, 0 deletions