unix: properly account for FDs passed over unix sockets
commit 712f4aad406bb1ed67f3f98d04c044191f0ff593 upstream.
It is possible for a process to allocate and accumulate far more FDs
than the process' limit by sending them over a unix socket then closing
them to keep the process' fd count low. This change addresses this
problem by keeping track of the number of FDs in flight per user and
preventing non-privileged processes from having more FDs in flight than
their configured FD limit.
Reported-by: socketpair@gmail.com
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
[carnil: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Change-Id: Iebadd9a42061bd96abd553228d826129bb62a59b
3 files changed