From nobody Wed Nov 27 02:24:28 2024 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCA0243AA9 for ; Mon, 14 Oct 2024 15:38:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920306; cv=none; b=VrpLsGAWsHRx+qKhZlsm7+mUiiihjaXnShjTpjWTMfSXx0P/W4wQrTUCrDfsiUfJ/2bsVV+8Tj/KYvnPXCPug7AWcFOhjQu0iu2t4BBnVirMALrfQiM71NtZsGK8mVVGFEF4IsruclkqTvR2BBrojn72nTGdLcjjEER9zhJeVT0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920306; c=relaxed/simple; bh=1bN+QEotEpIRBT6cXWz23R8634LnGKN+Ky65Id1kG+8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=K6pWutDF11D4XWKuW9dpWkVPpFv59r/VT0OC7dbJSJOYAoudoT/vRS1DtAt4xkpYqEmefwLQoLv5XSW/hJeVYnXtg4zNSig7g4u6fl3CDAFfoqcv37WArWMJax/qfZtgeKEPSg2WGmYo+YUvz4HmkbIFW8GGwY4ngsWBrzTKq7A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=RJNDVQ1e; arc=none smtp.client-ip=209.85.221.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="RJNDVQ1e" Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-37d495d217bso3951125f8f.0 for ; Mon, 14 Oct 2024 08:38:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920303; x=1729525103; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=oRUPHKnK+G7iaw/aUVaZN8QnmGwAZh5z1e5fpZvzMzU=; b=RJNDVQ1eKw80sPypm9wytcdbY4bKkip70lRcKlrDqwnKq89gcFV3E9Ml50zx5PWpiL CDK52zTEyZx4XxoMaulb37d4piZbghUzQ+JbGf+r5F23uxPBi7a/U9sPES9+Ea/Q/f2D 8p7rfrQT2YwtCMRYzJNkmrKH8gN+V13g1AdXy5xo6cGZ2/x6kVZFmIjviHKrymm57erx 5P2g8tNAtOGzFXPDbf1ebe2sM8gaxTyIgWIJ+OjfEvPUBtPUEVqlmO7ppz6W8E30qMuM WeMWefrYfQ4SxNLJEsnBkXjRYIKlKgN9yUPRUrH7OCLO5FgEZf5kIp+PrLQVjBWZlWS7 cHCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920303; x=1729525103; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oRUPHKnK+G7iaw/aUVaZN8QnmGwAZh5z1e5fpZvzMzU=; b=M1KP7oB0RF5RQXLdWuNZzjcE65yRQiYGAydhTr7U+EBUbWoQeBLdwmt9TOvJpZlJ+y KkKUyxmNqt24e5u1EohIO0WAIhtwlknXu7o5oEYlwbFWWsXr5zv72vtHPHpoyIeoJol1 KhSaP5OelKP2uxjmObwagcowXkm5DvPkglfwdE7egFaHj3pvkG7h74U3YkSFjQ3iQQCj u5IphGZDY7lggoucJrESZyffjde1M/3muVfpKczsz1Wb93vRi2w1qoNQmIVsIUH9dOmO TXwDXI/8Jdy2uUFlep/OWBHXU3iplH1Ivgn3q09BjiCsYm99TbcWQSLdQd6QQ/iizqxi +LpA== X-Forwarded-Encrypted: i=1; AJvYcCVAYWy0oHMtBlNbrXeDVrrWWjSnJ6Jn5lwyNRG2zfQurSGQ2DAZxKy+mqNf4a+FYLeJPDAR/n3BeBDqC/c=@vger.kernel.org X-Gm-Message-State: AOJu0Yw0rm2sX6jMeMfU7HP3USX6Z8m+EijxyoWY+p8j1m32B8LHIGy/ uimu5kxhxiJWVgmWnuLdfgX53dKY+DX+NJvjw6u5MtAn4G1S7eNNR4cyCtBhOtA= X-Google-Smtp-Source: AGHT+IEaE6C7r4ltNMskXO+tjNMKt9+qcANcSAGt9ehXwYkCcmFGRyHWUT3EcbTB5H99ngatuL8/sw== X-Received: by 2002:a5d:4f8a:0:b0:37c:d1ea:f1ce with SMTP id ffacd0b85a97d-37d5ff8db28mr6535195f8f.25.1728920303012; Mon, 14 Oct 2024 08:38:23 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.20 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:22 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin Subject: [PATCH net-next v3 1/9] af_packet: avoid erroring out after sock_init_data() in packet_create() Date: Mon, 14 Oct 2024 16:38:00 +0100 Message-Id: <20241014153808.51894-2-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free. Suggested-by: Eric Dumazet Signed-off-by: Ignat Korchagin Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index f8942062f776..99ae27d1e4dc 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3421,17 +3421,17 @@ static int packet_create(struct net *net, struct so= cket *sock, int protocol, if (sock->type =3D=3D SOCK_PACKET) sock->ops =3D &packet_ops_spkt; =20 + po =3D pkt_sk(sk); + err =3D packet_alloc_pending(po); + if (err) + goto out_sk_free; + sock_init_data(sock, sk); =20 - po =3D pkt_sk(sk); init_completion(&po->skb_completion); sk->sk_family =3D PF_PACKET; po->num =3D proto; =20 - err =3D packet_alloc_pending(po); - if (err) - goto out2; - packet_cached_dev_reset(po); =20 sk->sk_destruct =3D packet_sock_destruct; @@ -3463,7 +3463,7 @@ static int packet_create(struct net *net, struct sock= et *sock, int protocol, sock_prot_inuse_add(net, &packet_proto, 1); =20 return 0; -out2: +out_sk_free: sk_free(sk); out: return err; --=20 2.39.5 From nobody Wed Nov 27 02:24:28 2024 Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA7761AC8A2 for ; Mon, 14 Oct 2024 15:38:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920308; cv=none; b=Eh8wNirvML9RL6MEGWTGc/xTgKgVwugFlI4z6fNHimnkEMG+D9JwPFKXNi/9vM/o1UP733vN7LPJZpk4uWiH7Gb0jn7Ptpbw5gQ3sCoC8U0vImhTtP4w4YVMuLjqVJ9fuyg52HO2IqY5YgaHbHLpirE24e+tanrs3x4NTYBPLSI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920308; c=relaxed/simple; bh=Za6d2/ag0cx5W3bmCrv67Ur4+k+VPgr8uvsyupNoJnM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PZWY2nJC0SHoQ+GMq8Dvzx5P4+qoLXar0aPWmMeBcu1Z0K9yLa5z7YsjSbURPdKdrtjZqU9/jRVOCSCL0zHnlPN0QyZDrU3YtJCAHD1IHJa/h65aKXzbCniV5P2Uwl0GTxisd6LPlnMxGbgwfE8ZHRhUmww3C6wnNlx+LN/yPtk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=ADSl8+Xy; arc=none smtp.client-ip=209.85.221.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="ADSl8+Xy" Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-37d3e8d923fso3112770f8f.0 for ; Mon, 14 Oct 2024 08:38:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920305; x=1729525105; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TINcLHJMJcRO8N8gtca7WYNoZRWtOQnWeYtX29logTQ=; b=ADSl8+XydpCyUMT7zL3I7Xvi1Ix5wGUH5Qfk/p+HOYeLzB30nwmpsZnljcSmMl7gL1 f5gBFjsvjemCwOTBAn3BFfZok4/J5eKhgkR0d6LFhagydEQ9CXJVOiZeSuHbZh8IZ6Pl 4h+6QorPYZhw6NlENAoq5NXcVoV8SDgtaQFj+jV982TyCAhFCVV6luDMEjtEs7rHKnMg /CmjdtmnHerbQskx0gIUQFY4YluRL9dyg1C8jsGY57vCFoUF/RbPAP4xLWAJvi0UxtMy XhHNJZf0yIKgG9BlSHM8EIcMrPHPEc/6RFaVJdP9/HnrpApP7NF7p0Nwpp5905fxo0n0 jBWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920305; x=1729525105; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TINcLHJMJcRO8N8gtca7WYNoZRWtOQnWeYtX29logTQ=; b=cwdQQ9xXHOmM75/BJhInT4w6w2w/16+oIk9ndV6HHa9W4QSOWHJzLt7H6eKXiPqCsN mF7U68Fl7AE4TStKSfcajjVqxIhtbF44lLNJt3ZgUWpvmxi7pxGxL630jo9Syui5Dgy+ IN5wP/7waCHMazrTK4u9ZNCMRxJ4mywX4gsPhzjhGBr6OHC9jJw1+7HVKOHU+jkZkXzo SP9ZajgpAFDG0/lhgxy729j8Pd2sKLR8uXCl901CcRdLqIXX8HGbuKW4n3wuhEXsoTIY u0XTvtpbQ5enGRcXgzFYGnCLGRWNBIyCZVkKZlQ7WxiUkzmxwU+pGAVxHCl7zZZHLJMu TJrA== X-Forwarded-Encrypted: i=1; AJvYcCWcTdxmI6JTwQZae3Z6Qr3fCKl+5C50musjhlOlsMwmNMjdZD1HLmTPeh8UNNxG0i39iWqwFfzLMdL7nLs=@vger.kernel.org X-Gm-Message-State: AOJu0YxzSLZ1how8fVZI+ETqv4KEIrb4yFRgUYcGuwYQMBPJ/WfExvNW RUbHTRUC83QvidykjdPBCogsCBgn5brWHlCBl7VM8rJy0nO9WbfJLL2fj665FW8= X-Google-Smtp-Source: AGHT+IGI3bnawMCR2rBPHOoSypef3VQX2phi9r/huSmV/cqlV/2kFbNe9+Hj1byHQxm9DpEINFWl2w== X-Received: by 2002:a5d:5c88:0:b0:37d:4ebe:1647 with SMTP id ffacd0b85a97d-37d61afacedmr5574208f8f.49.1728920305128; Mon, 14 Oct 2024 08:38:25 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.23 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:24 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin Subject: [PATCH net-next v3 2/9] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() Date: Mon, 14 Oct 2024 16:38:01 +0100 Message-Id: <20241014153808.51894-3-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code. Signed-off-by: Ignat Korchagin Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima --- net/bluetooth/l2cap_sock.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index ba437c6f6ee5..18e89e764f3b 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1886,6 +1886,7 @@ static struct sock *l2cap_sock_alloc(struct net *net,= struct socket *sock, chan =3D l2cap_chan_create(); if (!chan) { sk_free(sk); + sock->sk =3D NULL; return NULL; } =20 --=20 2.39.5 From nobody Wed Nov 27 02:24:28 2024 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 378221B4F25 for ; Mon, 14 Oct 2024 15:38:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920311; cv=none; b=r1wn20ME1ThHY2o+lTK5Yhg6XjtlrsdCgIGF6zVaW+xSgZ2cH4pfI2HcScVuKd5BWIIet3NVzaD8EdzYg68VkANFLzqtfYmwghoPfekPT/SfJQikI3S2QCR/PrlpQKQETtLyu9BoAxcyIMWLX79nEYqcRE+HJbipUniD5Rw/51U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920311; c=relaxed/simple; bh=GvHicGdC5gF55ThXSZt1O/NLZ5Cy+z1ts4hoVbPvBIE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=o7bWrchavbiDR8ZAkW6E21HQOsVfej5ipEdq/S/yhTRXG2RZ0HTY2iocjScj9TQIq+wtgU+y1nmS4fqFp/4fbsY7hZAK+E+BU0HGE3Fxdm5/7ofY3z51MLd2XQLbV6AuS/HSUJkS58gmLe9oG/h74vC91nORi+geCN2L6qSYyXY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=c9tESvC1; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="c9tESvC1" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4305724c12eso33542005e9.1 for ; Mon, 14 Oct 2024 08:38:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920307; x=1729525107; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=JRe2C+foWbcov6G7P3m7UzBNc36wNTYgM3II8ClmqRs=; b=c9tESvC14rgTwhPvzYHqFoBqPQ1vxoiSX9RhESYC7q2TQJ1kln8f9U0YbQTpSsJVhI zPNsB/6rBD7N8OO9qL72i1c/7UWYUZHTY6XU+IY8qdRE9MSZY30TVt/kJalkzIH/PQRs zXZ0zjyT7+394U6mIBXd/gk20oBgk7lcL0P61DL9aOYqPXotBypDGiRp7/gJTBTRQwyB 6QLU6HGBB98cyYowz8Tpl+ajRXZELGmFoCReTE02JwUcM5GqhHG6M8lJaI2SsV+TkbKa lWLM41dklrpcVMOwugPg7MuztTS2zJ/VHzeqHh1yP4CQmasICfMt+YnLRPKMA6Ob3PDF D8LQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920307; x=1729525107; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JRe2C+foWbcov6G7P3m7UzBNc36wNTYgM3II8ClmqRs=; b=smHZkMt0Javk9fFS8sFvuLeAJGJdt0XusR+qt0mjZ/bhfWYIv/J8bYwnU/7AMoKv+5 TeoHU59q7cUEg03hzjvD6fsrGqM9aS2kkBC+P5v6ldP4dTHEb5uacECZBeqlqQe8Lf40 WFVhZcMpUqt6bOhqhH4IIUjsrH2hNQAWEe1NPs9E9IadRVh1L5qbzeTSDS79++Ncx79Z MBIgkikYtKYiIGSR2rkfNonmCWsAaFsDVOpsS4kp9UPUcpSBG0iJKB/Ti9FJ9td0h14i FmJYACdsS3wR/RdJKXl/h0NDq/7ZOAfCcgY159OUbDbsJ9DIDI8klMLZNqBi4YusslYQ FU1w== X-Forwarded-Encrypted: i=1; AJvYcCU6pkKswh9v/rmQJDdI+NVvsaCfFjvPEzSZtuFZrf8ej2oLt4E52MAaGofJozYDFbfbiyXrP31nz39i0I4=@vger.kernel.org X-Gm-Message-State: AOJu0Yz0hWYTUmXPJb7GkL/BQEgpySNxxCf+6kXK+x7OryPqEkqPtmMX mZw2r6lMm0LB7hMEdt67rsbH07N6PqDDvzsNBuTfdQPjsW733Bybt3nndWWPtDI= X-Google-Smtp-Source: AGHT+IE4BazPIerb4dni+agrzlUjCsWIGS3LpWQM7q1t/kfeDsxhJlB9u9/bMMZmGbUUqKUZP+ZMNQ== X-Received: by 2002:a05:600c:1c09:b0:429:e6bb:a436 with SMTP id 5b1f17b1804b1-431255dc867mr78702245e9.9.1728920307425; Mon, 14 Oct 2024 08:38:27 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.25 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:26 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin Subject: [PATCH net-next v3 3/9] Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() Date: Mon, 14 Oct 2024 16:38:02 +0100 Message-Id: <20241014153808.51894-4-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release the sk object, but leave the dangling pointer in the sock object, which may cause use-after-free. Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc(). Signed-off-by: Ignat Korchagin Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima --- net/bluetooth/rfcomm/sock.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index f48250e3f2e1..355e1a1698f5 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -274,13 +274,13 @@ static struct sock *rfcomm_sock_alloc(struct net *net= , struct socket *sock, struct rfcomm_dlc *d; struct sock *sk; =20 - sk =3D bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); - if (!sk) + d =3D rfcomm_dlc_alloc(prio); + if (!d) return NULL; =20 - d =3D rfcomm_dlc_alloc(prio); - if (!d) { - sk_free(sk); + sk =3D bt_sock_alloc(net, sock, &rfcomm_proto, proto, prio, kern); + if (!sk) { + rfcomm_dlc_free(d); return NULL; } =20 --=20 2.39.5 From nobody Wed Nov 27 02:24:28 2024 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 571261BE23E for ; Mon, 14 Oct 2024 15:38:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920313; cv=none; b=dp937LGxfzIKBdOnyCrslIrF3ExV/GUJr7rPlt02OwbnUPkLdJH079aQ27tHtLmgGgIWY4bH6sDhErWvDnnevHyRJ3jqi6tcNkmuYWtuMvdKydU1oUQt9dUb0pBfAYcr+O0mbNOVP82iM1UIwyFimjWxj4G3pzEHWgFkd885dOQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920313; c=relaxed/simple; bh=VxIucDQGPpRIS63YRPMZymbS4KIO0Xi6qKhd8KI+CEM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=YDgwAdFaiX+u4deaqemutxqezcqhlaApSTn69lH0On9QhquEXLc/5a4reInl+2708t/+iuQNJFK+PCHhGO0cIulMbPCgqWDuhjEhnOYQ/vY3y3aPN9vlNao7+G2FHG65610suD4GGkPQU+qtWN686Ch1scDYj0Iym4bWktPuMb8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=Vad1vHip; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="Vad1vHip" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-37d5038c653so2713931f8f.2 for ; Mon, 14 Oct 2024 08:38:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920310; x=1729525110; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=O6Xk7yX7Ph55Lc4GYMDFLX+bnVww2jUFr9G7tdaf2DM=; b=Vad1vHipC/p2/XtODd31RqwRkdJZEMHRVgRy9SG4NqIzw1iQazmgdAiU4BluBxi13O ftd3QpSLOHPqR++Xq91lCMX5jl1KHqq+pILVUmMwKHrAypQ1BQmsRoGfkirLF/dZqKiV McsooJuI1ae0ZKXKTeDZv9PtB34ff3ZYUsX2irH515TPamHMYR9uPxkr66Tivz0kJlGh LJOfy+pzwCFZleHT5d2X3rfkWSc2X//UmxQ/6KE87y3twdOwy0wAa6E6NDeIXNPeqSBz FwUjPSZ4QY14yW3hxgOda15xCEpEgb2RbDLPp3tDGtTp+fQ/wHe6y3hS3N2MmorCWg3E u+pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920310; x=1729525110; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=O6Xk7yX7Ph55Lc4GYMDFLX+bnVww2jUFr9G7tdaf2DM=; b=mmTGyWEEuS1YYukO/WLKFDgVxjjQPBxqmtXx66BZ8Z/cu1yNirWSIXY5iUYo2M8Rb2 jECVF8SWTpAfle55j9YjQ5aN0HcoQupZNlIUykwFFN5LZadmjsbBQ7lS9EyxSAIMbnML Pn2cip91ACLa16y5PHXhA9EkO7gaa+lwRnqInQBWiY+vh/iYEJytL3zZZ5lbS0yldueW I8FDrEzM6H8QCMRhdNvgMqdr6qal0ICTLQiXa/PGnjhdmp/z6mtdpeW2bl18FaJ6em4n WdrmisQtVF/WCHHvNEuwoP/SxmZshvOLU7cBMfdeF9TBL8StX9ozteTaUmgKsp7dKLPY 99NQ== X-Forwarded-Encrypted: i=1; AJvYcCWNAXF06SB4ZnQNh4Jb+G1FgBBT5hJHfYg/PIg+Uoq8Lu8SK39R9nZFH+8Br0KgTBf5pWWok5z3bfHTgp8=@vger.kernel.org X-Gm-Message-State: AOJu0Yy6Vr7cGrVt21m0tqO0rmuVlze5qRJ+TKhRNJHXR8/XESQ5zkbE T4d7CANHRuzmrxJ+hjBg77BGb7TWd28Eu5zJA1exOGqUpgrgsj7rnqjeQKs84yQ= X-Google-Smtp-Source: AGHT+IFOjny/ZC5vM2XSWOXaR36r1j+H8geu/8duRN5SiAObjYA/9oL5xKSu3VUf7L1WrDRmThqGmA== X-Received: by 2002:a5d:6687:0:b0:374:b3a3:3f83 with SMTP id ffacd0b85a97d-37d552cb66cmr10142454f8f.53.1728920309727; Mon, 14 Oct 2024 08:38:29 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.27 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:29 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin , Vincent Mailhol Subject: [PATCH net-next v3 4/9] net: af_can: do not leave a dangling sk pointer in can_create() Date: Mon, 14 Oct 2024 16:38:03 +0100 Message-Id: <20241014153808.51894-5-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later. Signed-off-by: Ignat Korchagin Reviewed-by: Vincent Mailhol Reviewed-by: Kuniyuki Iwashima Reviewed-by: Marc Kleine-Budde --- net/can/af_can.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/can/af_can.c b/net/can/af_can.c index 707576eeeb58..01f3fbb3b67d 100644 --- a/net/can/af_can.c +++ b/net/can/af_can.c @@ -171,6 +171,7 @@ static int can_create(struct net *net, struct socket *s= ock, int protocol, /* release sk on errors */ sock_orphan(sk); sock_put(sk); + sock->sk =3D NULL; } =20 errout: --=20 2.39.5 From nobody Wed Nov 27 02:24:28 2024 Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7C10E1C3052 for ; Mon, 14 Oct 2024 15:38:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920315; cv=none; b=Fe+7LD0EL9wB+Xb8Ny3gI+l1JlgeTSRgKfL/OjeSEuIB+/2cpa6oozyTQisv68iuTdoDkoXfdwv1qZM4DO2/WVvlZ40i1j9t1OuE7Qw13cL3V/lE290GbWGruZbyaja1JITyxqbbballXTVuqb6tGCNfVbLmMuT+435ydksVQZo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920315; c=relaxed/simple; bh=XZyeSxYL0Rt6XzD7DrYNwyUkhIbWdcwwkzg4XCE56kc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=CcqefABVITYYrKaXub2otuDehbzGdBwt71HPecT/PvOCponjsDUwrYxE54+3j3AEMibEw0iMytworIZP6mXCg6xSudLGfK7gWUdSSUOQv9QBTxvjmVVO8EsIggN6L3QuI6jRJdgs36zDnWX8ykDqV1XFloMlmqbT7SXGrYyQe18= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=MdISMh2T; arc=none smtp.client-ip=209.85.221.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="MdISMh2T" Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-37d4fd00574so2636708f8f.0 for ; Mon, 14 Oct 2024 08:38:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920312; x=1729525112; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LbHwWEpfmVr6vDfNAIj04FaBgRdnLx3F1Vt3RjTwrtE=; b=MdISMh2TxSBfUoqF8lTK+6J6uQKXbIMCfJrZTk/6CZNGiMzcPt68ImPAUhDH1m1dsz YJt23V5EHT/3HQhGRkewF6ynT3sir8fRvYKPU7kHtDC7q3OixowsoNhWb9pr6RCUlAfy ugZw/0YAW4yk2J9nc5U91yhNcRty7slQaA1wNFo9x374UmFLU7WFxsQmOYUoMH/654Br qdLOyIjIyUFEoQbmjsivrBkTGwSRSEeA2j5+FxjuGVJ/ufP4iIHrZZOyW846EWEnklg5 s8VTZaN7tu9iW2Rz2rC+fz/1in2k3sDZhLeAlrvIDgtEBfmH+vhn0o/K+iyniUo3b95p v3lg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920312; x=1729525112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LbHwWEpfmVr6vDfNAIj04FaBgRdnLx3F1Vt3RjTwrtE=; b=BC0AnPWpTsWnxBLqaurAjE1mx3xMrlZBGVAeKvy1a7hdFFRTL+i7jDc76lJrbAcPEP aU01JT2DPOGG9shFh1hFbUgJWqQwEclF+O8MZV6Z6E80nICQtybETTuAOW3WQ78cXy2c aQQUC8oqR12zeMedb+SHIO9ymTstbhlCIVmY1PmBd2q50vlS9P4ridHarq7pPhzKWvJY N6Bc6LLQdPqRc0S3MnKJzZT9WC/vIyEvuX35HUeWPPQbioqxIVkYA+wVj9x+w6jMFzb+ DfDAL7YobxbqlfJvyAehNyL7fIwqnwIzk7eqmq69oDAZVXf1lN3y9ui6rNrw/51EeUrk DGUQ== X-Forwarded-Encrypted: i=1; AJvYcCUUI5/O+DCJMkFKU9gRkGrCC5b3Ldvv8lHTyUo6biHXUT86IXAN38Et+e8VVKnHOhbZIQDZFrhluArKPAw=@vger.kernel.org X-Gm-Message-State: AOJu0Yx61soj5ys9kc56zvWzCWgkZCZEG/yQEqiDzysFt9PyjefmNYpx VnVEgc0+OE/e9XhiXxpCJiH/5B+H1Bfnuru5pRi8i1Ply4laBy0hloLEheCN98s= X-Google-Smtp-Source: AGHT+IFpRrcvyLwLdEFLQDdJiBx0O5p4UCoiCY7EDrHsmjdj7yCbqKDU3xbbCNWtcTob1sB2WmybtA== X-Received: by 2002:a5d:504e:0:b0:37c:ce3c:e15d with SMTP id ffacd0b85a97d-37d551d9cb7mr8770131f8f.14.1728920311872; Mon, 14 Oct 2024 08:38:31 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.29 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:31 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin Subject: [PATCH net-next v3 5/9] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() Date: Mon, 14 Oct 2024 16:38:04 +0100 Message-Id: <20241014153808.51894-6-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, which may allow use-after-free. Clear the sk pointer in the sock object on error. Signed-off-by: Ignat Korchagin Reviewed-by: Miquel Raynal Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima --- net/ieee802154/socket.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c index 990a83455dcf..18d267921bb5 100644 --- a/net/ieee802154/socket.c +++ b/net/ieee802154/socket.c @@ -1043,19 +1043,21 @@ static int ieee802154_create(struct net *net, struc= t socket *sock, =20 if (sk->sk_prot->hash) { rc =3D sk->sk_prot->hash(sk); - if (rc) { - sk_common_release(sk); - goto out; - } + if (rc) + goto out_sk_release; } =20 if (sk->sk_prot->init) { rc =3D sk->sk_prot->init(sk); if (rc) - sk_common_release(sk); + goto out_sk_release; } out: return rc; +out_sk_release: + sk_common_release(sk); + sock->sk =3D NULL; + goto out; } =20 static const struct net_proto_family ieee802154_family_ops =3D { --=20 2.39.5 From nobody Wed Nov 27 02:24:28 2024 Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 989CB1C2DB0 for ; Mon, 14 Oct 2024 15:38:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920317; cv=none; b=kdC9O0B68A2DXVR7WmrGoKkV07o/cPNO+GaoH31DRtlcCO0BvDzIaRPgehThAnXmALWEampT7ZLCDNVqlKwGCFNeMaclvUyHb6O2lxS7+NeflIgO3WQ4TUdZ5NgKKJ/5CN4ByAdVU6jSEruLZ3RouaukQdXfHBdnp9tpdT/kgI0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920317; c=relaxed/simple; bh=TykJJMM5IzwfbahmKZJTnRFTzpHvJ80eOgoE0YjZMYM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=QK/igDEJE5AUEShOPQKgNCqx9qGdygQxpATIb7U546G0aH8zHGGeoprciVIWvKvffpbOHTaZn7qtw7w/CBNlhEXoFRpr7lQT1nzTCIF38rUKa4Fu02je/SIU2q/qIISjr/eRsif7/+Uv/Nze/ETkUhOhPprNH3RWk6bkkICB2KA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=c3QI9aUK; arc=none smtp.client-ip=209.85.221.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="c3QI9aUK" Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-37cea34cb57so2958751f8f.0 for ; Mon, 14 Oct 2024 08:38:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920314; x=1729525114; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=49ytr3oVzMOQdVnJdbtLDkZg4U2+YqG6lYXkOtuknMY=; b=c3QI9aUKu6Bi2Q+b8cXS2JW0XWkQrdIxfWRocPjUJ4ipX/DnkFkgfFSoH96GxQjskv H+s5a4sZHs/D1d604fpqEK01TyCQyKdFJfgkd5WKBzAQ4YFDKPAuRNsEujbfaEd0wOhk U2hsj7sc/AdfjvUi3lHThlaDFMkKysLdxdMTn4G92x94laSnlToVfQ6jeu7c7CEluJLR X7FY8MsnnN/Lg7qWc2A6dzJdJOp1vw6kW+mXrHEJdVrmmt/tKVS+YhzaH1YxoMHJrjNA ENQozVzUkLa+X1wb/Djdwd/P4v7UX4Lz8Znxc0zcjnVBrmGvRw90fT6hrOYEPY+RxGlk mttA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920314; x=1729525114; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=49ytr3oVzMOQdVnJdbtLDkZg4U2+YqG6lYXkOtuknMY=; b=ACbW9KJmklWpelrNsqrHh3Fgrc6QKvUUxF/EC3nDcZeGfJZRhmeKP04+cZ4eyw9FSr AeJP/hRcv4M1rDSdr44x/ED3otHbubG0OmAfFUen172nR4O6609td5WVIXVBUlRlP6lY DkChuct+20YW9KSO0lyYVAnMn2pIfbmijzM3HPcEpHipjLo/QvEqoMGewgUmgw0ldEH9 L6d930OpKK3wmCf9y87/Lccw0Dz3KwfTSoPbCQQlfnoRdQJeFGQHx27Y/XDjwtsB1kLQ NrBTnlROE8lpgWjzoxAs8jxulm8CAiB4N3dbcftzWgV0kI66cWYcrUQIkduTVLPIEbiH 3j4g== X-Forwarded-Encrypted: i=1; AJvYcCWoxY4NB0hbaAQgEC0N2cunyABQCGt+Qn9Tf3/14aZliZiw28uPPT0dktB4O+O85JBK/jn4Fo0ikbjFg1M=@vger.kernel.org X-Gm-Message-State: AOJu0YxEuNSgi3jWXxCxCc6mfwyJ44imNupNFM2agm+MNA3XKWal1uVN aed3Pch8ad3WsgBDfcsuk84/vA+EcmesXWtIJFe1oaPb1NsoO1qb9rweRLaO7r4= X-Google-Smtp-Source: AGHT+IEK1fXfdN4ULr/3sLohnKiPnjVrQV68cRQbTA59WSVC//oUJKPx9zNQVb7mUdYnIwSncrGyLA== X-Received: by 2002:a5d:688f:0:b0:37d:50e1:b3e1 with SMTP id ffacd0b85a97d-37d551b79c7mr8936288f8f.16.1728920313945; Mon, 14 Oct 2024 08:38:33 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.32 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:33 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin Subject: [PATCH net-next v3 6/9] net: inet: do not leave a dangling sk pointer in inet_create() Date: Mon, 14 Oct 2024 16:38:05 +0100 Message-Id: <20241014153808.51894-7-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error. Signed-off-by: Ignat Korchagin Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima --- net/ipv4/af_inet.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index b24d74616637..8095e82de808 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -376,32 +376,30 @@ static int inet_create(struct net *net, struct socket= *sock, int protocol, inet->inet_sport =3D htons(inet->inet_num); /* Add to protocol hash chains. */ err =3D sk->sk_prot->hash(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } =20 if (sk->sk_prot->init) { err =3D sk->sk_prot->init(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } =20 if (!kern) { err =3D BPF_CGROUP_RUN_PROG_INET_SOCK(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } out: return err; out_rcu_unlock: rcu_read_unlock(); goto out; +out_sk_release: + sk_common_release(sk); + sock->sk =3D NULL; + goto out; } =20 =20 --=20 2.39.5 From nobody Wed Nov 27 02:24:28 2024 Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A80ED1C9DCE for ; Mon, 14 Oct 2024 15:38:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920319; cv=none; b=mCnEGdzsQVNYPsoUMVlnrFim/NHYnGuQGF+s+SvIXIjqPgiDzFLYXFnqyfpI6Uh4kgz+hlZVUl2tW9NTKOeq4yhUWFCO3Bzismv7bb82+SJtpgk8Vy2yMhmbq5TJxZfih0eJAOr8CgJMPVv4MUxIExcu6YDx2jF4Z3QtVtKtXBA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920319; c=relaxed/simple; bh=B2jIOs9L3gzL5PsTv6zAjfQ7uhJ1V7bXBI/aVWUwbYc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=SEyEW7ValQQ4NakAqHkDP6wHicDOgeLvxd+JEMSO05WCAmSM6VP2ZBwcYDSYtbkRP08J5102uxuJSUB7rvac60gJ8w///m+a92ZVA9P6J9Hq4Ert4NfH/aV1JQir7JFDRhJ+6sZYKs51iYTZoIikTqaiuVsDVl9bKmKG63E3SV0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=SPE1k1J7; arc=none smtp.client-ip=209.85.128.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="SPE1k1J7" Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-430576ff251so38688525e9.0 for ; Mon, 14 Oct 2024 08:38:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920316; x=1729525116; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=lc//y1BjgJvxxX3rGB4aDZ3xX09SUgENBX50qA84hL0=; b=SPE1k1J7Xyw6fn9/LNdrjheqnufXMsYV46py4ESfUl8mdSQlzej5qYsDZxYEqdy3Up lST2arihYhJAwrVaDiWxPAFAr4Kt4TnwUQphBB3t4qBwZYf1XR3RwMypulxICZ3wuFBd uuWzv8EwfsWL4c32V/yhFBeLUCCJGJIqzyhx/JssqBwUi4gXm/ldf5EUnFUgUBtqenBj EPr/x3GYJnXxTHj31QR3Modr7kjEEwkfF7siPzXobiFKcN3OktPrDOhQCo9rb5onB6+c G7h/H0h3VT7biQSEsl7BXXKHnMFuRWKbaC9AG2jhYAwwEd7N3E9fIgoJOP9oEFjoxwWb r+sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920316; x=1729525116; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=lc//y1BjgJvxxX3rGB4aDZ3xX09SUgENBX50qA84hL0=; b=nyfMuC+oB5dVDX5JGypQs4ninp6s4VuStTXkYRMyIKVNuyIm/Qb7hyB6QpZfQeHvko vlvhl/Gg4BPO+XouvvUD/KRNbODOwPejix4ek1PGQVCbA3g/TaEDwSo/jlUyjcsj7QZ3 3OddDoQ63ke1Y1imvQJhdoHFPx9D/I/SUIn4HVCsX4AaNQVYVOU0cPwrUMKKMRXu81DR SXzhw2oLwC0nKvLOfxKT4vIFyeqEj81vOHrFZNlMb1ldH1J+yyrr1zIV4Vyl+ZFLYULq AhI7MkRvQGKJjl92jM4D+pU9XUcB3p+OdoPqFTYea4ml/CSoNOqp6X8Y1XjQT0qmPivI kF5Q== X-Forwarded-Encrypted: i=1; AJvYcCX2sSHO5i7DVNSg0gqyAdvsd8hvM6tooiQXLekplmVxtbZDc12mZutVlJlLcXw/7F2uEoZFIvlS3M+f0/w=@vger.kernel.org X-Gm-Message-State: AOJu0YwSmcBFPa2hhgnrsPVCf0FB6e2MeW2Bggp7Z7Kc8dKJevfT8vo4 i/9uByILoC6JBE0c9j9ME1fAh6kTN7+W2gq6Kpe6TSmt5vTiJKZ0p6De4q+4P2E= X-Google-Smtp-Source: AGHT+IEIDg1NkYP+jkdfN8/Qy2bbNOJCew4tzqQ4wU+J4Bx2YgcvD/tGgxkQdWC68y3Hu3c+jOjjEA== X-Received: by 2002:a05:600c:1d0b:b0:42c:ba83:3f01 with SMTP id 5b1f17b1804b1-4311ded4265mr95708305e9.8.1728920315951; Mon, 14 Oct 2024 08:38:35 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.34 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:35 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin Subject: [PATCH net-next v3 7/9] net: inet6: do not leave a dangling sk pointer in inet6_create() Date: Mon, 14 Oct 2024 16:38:06 +0100 Message-Id: <20241014153808.51894-8-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear the sock sk pointer on error. Signed-off-by: Ignat Korchagin Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima --- net/ipv6/af_inet6.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index ba69b86f1c7d..f60ec8b0f8ea 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -252,31 +252,29 @@ static int inet6_create(struct net *net, struct socke= t *sock, int protocol, */ inet->inet_sport =3D htons(inet->inet_num); err =3D sk->sk_prot->hash(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (sk->sk_prot->init) { err =3D sk->sk_prot->init(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } =20 if (!kern) { err =3D BPF_CGROUP_RUN_PROG_INET_SOCK(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } out: return err; out_rcu_unlock: rcu_read_unlock(); goto out; +out_sk_release: + sk_common_release(sk); + sock->sk =3D NULL; + goto out; } =20 static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_= len, --=20 2.39.5 From nobody Wed Nov 27 02:24:28 2024 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B28A71C9B87 for ; Mon, 14 Oct 2024 15:38:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920321; cv=none; b=uGyOpX0/0FssuzeQDPjj5P/5/l3lzlZM2q4UVWFWGsiN6PVjNcT9fIJVRc5VUEqr2dgWoRiBo8xl+oh5Kl2aU3A0RGNlExmK2UGmdEOzdM79VOAA4c9utE6B9iO45Kvwjpxshg9Gwuhiyt2PQUczfr8IDEbQR6HQc700o17Wwi4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920321; c=relaxed/simple; bh=tpRnxtvyDHesMuGsYGGagBR2XeIwxtaApq6sfrvnYrY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=fGN0R08nHI4IxfGRHODXI9Rl3pm+ZDcZBPXOpABGpWoQA1cxOMVY0n8bUe6YA9WDQP0H/waEjr4kayx4Gx1lg0WFrwsh7CCA4u4TivCRSZPQFadFc/xsDU8ID7roI9h32fNThGvqiOL5B9ZQudOPMLrQmHGEPOpc0GlUuHZl5xc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=gHmxVmqE; arc=none smtp.client-ip=209.85.221.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="gHmxVmqE" Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-37d4821e6b4so2737386f8f.3 for ; Mon, 14 Oct 2024 08:38:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920318; x=1729525118; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=NRdyGf4lfZr6TznDuyWqYCBTl3G4Nizl8+blfyYvkoE=; b=gHmxVmqEAq2H3WSZdMhuCmkb7TtWIvdeoxB74oty9UCExauTw/LyGcw1zxvAxXy+dl atl6R+YmvG/iOTONZWptqoYAvtsk18MOlOEoxma5Wm9/yUeJwdWl2m7eHekbakfFlNsp 3WRnxaf09V5yQcY4IoY6C+Cn9sYW+fDiuUm5RphdLf0PVLs2lzP1O8RgC/9rKGMfn7MT V6zcXMCuSi4hB+mipouR6I9AqQY03la+55wgk4ESopEG5IFPB6HGn4BzXSeHR5OS1/ef 25NRI8f0N7QtIu4fS/wpbbzKeoqkr8TXRr5iXDmJam0flodQyZ9ydnUGbxvSGqVh0tS8 iGRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920318; x=1729525118; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=NRdyGf4lfZr6TznDuyWqYCBTl3G4Nizl8+blfyYvkoE=; b=gZqn/HD/PebxgK4sFgu/ukiLpd806BrBdTTh08qZzWGta7a9I05RGzJ29hCQEc8gGd 8OpKbdgCmTGFsdAhzY7K7hTBDY5CSC1T7GBzxXghS9EMqim229/dmHoF/y7fycpO2o3e f/v2zttUt5W8fRkCazxAQlXU1CIJPYQR313DnmGuM5lQTmuxKFWyyTwK5sf905BIPELG BpiuFVr0KLaBAJPxAmxw5/nsd58EsI17J6yt5dmAmeKO7yy4F4cVLBlenGEZTog4+9us hW7umnHVIxBkjGUq3xWGP7rrScsFVtGLBlyr/H6EpB8lKUMfl8aBTKPbkgAD1Y0OFoYB 8jSw== X-Forwarded-Encrypted: i=1; AJvYcCX2x/H8ThTMpE21OFnb6G1Yk8TEVmQh5Iij7Kwt6xaNu15JoHA5gtZkGNzKLIa34eS7NMXsgV4YCFLxtQA=@vger.kernel.org X-Gm-Message-State: AOJu0YxZOpWs5XVeKHszF0bLaSUfRo2xPi9wQZaa/fvdrEKrTN9kVfPj bgGWjiMeZbN0ShXGYifgydnevCBcTgVzvQVDWvFqGAgs3n8GseUQeEDAibO3SuQ= X-Google-Smtp-Source: AGHT+IEvSESGNKtr3mfQllscjnvWPixVZXXYDJK2VErqCT7tUm2cqjBB5hZh+pW+OcOgTVIOFBIPag== X-Received: by 2002:adf:e908:0:b0:37d:3def:2a82 with SMTP id ffacd0b85a97d-37d5529acb1mr9092817f8f.36.1728920318048; Mon, 14 Oct 2024 08:38:38 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.36 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:37 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin Subject: [PATCH net-next v3 8/9] net: warn, if pf->create does not clear sock->sk on error Date: Mon, 14 Oct 2024 16:38:07 +0100 Message-Id: <20241014153808.51894-9-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" All pf->create implementations have been fixed now to clear sock->sk on error, when they deallocate the allocated sk object. Put a warning in place to make sure we don't break this promise in the future. Suggested-by: Kuniyuki Iwashima Signed-off-by: Ignat Korchagin Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima --- net/socket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/socket.c b/net/socket.c index 24b404299015..9a8e4452b9b2 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1576,9 +1576,9 @@ int __sock_create(struct net *net, int family, int ty= pe, int protocol, err =3D pf->create(net, sock, protocol, kern); if (err < 0) { /* ->create should release the allocated sock->sk object on error - * but it may leave the dangling pointer + * and make sure sock->sk is set to NULL to avoid use-after-free */ - sock->sk =3D NULL; + DEBUG_NET_WARN_ON_ONCE(sock->sk); goto out_module_put; } =20 --=20 2.39.5 From nobody Wed Nov 27 02:24:28 2024 Received: from mail-lf1-f42.google.com (mail-lf1-f42.google.com [209.85.167.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E7E61CCECD for ; Mon, 14 Oct 2024 15:38:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920323; cv=none; b=kE9nByeGkW9nBJ0UavZTNeSxqpoamP5Bh2BkWEbaMO0gRI69NfDAUEL3wPUYGPGMXSSDacCvJBgr7vgokUZXZaTRP+jgDwLmKle81gcIIuOxkKgfneR+izsmjLua4Kkxl8Y8naYuSNVj5Y2OGGawViZ9VJQHiVOrNuP/YqEcDCM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728920323; c=relaxed/simple; bh=vc7OmTLH/01Z8jEmhW2hCpr6OvlMbxkqSwuRPTgWIpI=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=P3Xl0Heo8Mdd6ELCP/LpRGUd4ljYzkkj1lU/brDa+QEWy5Thl/ykOg+wTUUJqa0SjwqX4rNsI/vxUBh1T+yTOYpPPmJUg6bBEsOnz6KdBQrIAUCvICAcEkkje9WB9/u0QiPJ0IeuwqSVUxjHDlWB+FKFwz7FKESaMFLguTOTljY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com; spf=pass smtp.mailfrom=cloudflare.com; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b=dLXBS2w2; arc=none smtp.client-ip=209.85.167.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cloudflare.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cloudflare.com header.i=@cloudflare.com header.b="dLXBS2w2" Received: by mail-lf1-f42.google.com with SMTP id 2adb3069b0e04-5398ec2f3c3so5187647e87.1 for ; Mon, 14 Oct 2024 08:38:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1728920320; x=1729525120; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ItWQLKHEonR5Y2Gfm40nvdSQUxBxC+w2AGE8qbV4gnc=; b=dLXBS2w2f1B913FYyVksZ5CxT2FB/P+tRs39uNyDlb1TLRWeUYT/QYawOi8x+N/P+A 5aQHYM+8mrlX7YEBLYq8XLQBif1j4y89y7ftPmjBbwEOjVsnOyZaA6MccY0LRNw9Sh2G tekWzAPCmS56R6wJRU6tmBWaZ5GkEmcQjGoK0K4jRC3RM3vHaKsC98ZF1nxUAZgBHM+d Km1YwFDgIDCPIejfnApah6wZQCkqro9Nb0q8WndtlIUTpGV/iq6rl5BRz0263+HpQwin ym+efHn4fKC1o991FRtxIXc0i7f5Y1lqe+K5B+K0kDgacoM/HiIcd3HUZFM+zv7Vajvk U3vw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728920320; x=1729525120; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ItWQLKHEonR5Y2Gfm40nvdSQUxBxC+w2AGE8qbV4gnc=; b=pOXsLvl+/7lEYn1zdYc6aAEYLAE6AQbMRdJhhI+Ncd4rbfWyvIrQLc+03mgmZR92aO 2rFC/viR/jUraFNHpC+uAaHdyHrvjaaQn2oIGITk4VsY9M7CInkMHTZ8tIvnEqvxxPw/ 3ts+5jDMz5En3H5LD34ulOFJ+y6yZl0iHkkLEhIomzAUbyDEGJt2jf15VjhZkEsXMHMX MlDNzvgm3SIDFjyZiPttA/1ittgbkAASXJvkav/NU+9UY5xr4TJttbgCMJ7Nh6M7+ZkP JC5nbuqpcIg8uikQ0++XZ0eZqBc6yi6qH6WvJHK687gwjVc0tPmvLWuE47AYe+8slWfW ejOA== X-Forwarded-Encrypted: i=1; AJvYcCVefQv+P2W53A8kpB9OTKzmUs755OqojmUT1PAC/eeoRRPBR/U5pQomaMuVxUiZhKEYCgo7aW/m1wBzba0=@vger.kernel.org X-Gm-Message-State: AOJu0YxMt4DYOmtKxO6SUlgEqO3X7UyaRp+5Y7Mj9MjmGVmiPnfTPWk9 hs5KgdxQGdJHmAM2cTO02rNM956oXKw2KHGVXt2Ws5zlKK6GOa5s5aw02IgpvSg= X-Google-Smtp-Source: AGHT+IEttcKfkHe5cPisVJHUtmgl4wcFxdt3iQxg/FUhY3c3ela4IwMd9TUcQCCkSzxomrcD8IPSrQ== X-Received: by 2002:a05:6512:3083:b0:539:8ade:2d0 with SMTP id 2adb3069b0e04-539e57282c7mr4527098e87.51.1728920320165; Mon, 14 Oct 2024 08:38:40 -0700 (PDT) Received: from localhost.localdomain ([2a09:bac5:50cb:432::6b:93]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d4b6a8940sm11725913f8f.6.2024.10.14.08.38.38 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 14 Oct 2024 08:38:39 -0700 (PDT) From: Ignat Korchagin To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , Oliver Hartkopp , Marc Kleine-Budde , Alexander Aring , Stefan Schmidt , Miquel Raynal , David Ahern , Willem de Bruijn , linux-bluetooth@vger.kernel.org, linux-can@vger.kernel.org, linux-wpan@vger.kernel.org Cc: kernel-team@cloudflare.com, kuniyu@amazon.com, alibuda@linux.alibaba.com, Ignat Korchagin Subject: [PATCH net-next v3 9/9] Revert "net: do not leave a dangling sk pointer, when socket creation fails" Date: Mon, 14 Oct 2024 16:38:08 +0100 Message-Id: <20241014153808.51894-10-ignat@cloudflare.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20241014153808.51894-1-ignat@cloudflare.com> References: <20241014153808.51894-1-ignat@cloudflare.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This reverts commit 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2. inet/inet6->create() implementations have been fixed to explicitly NULL the allocated sk object on error. A warning was put in place to make sure any future changes will not leave a dangling pointer in pf->create() implementations. So this code is now redundant. Suggested-by: Kuniyuki Iwashima Signed-off-by: Ignat Korchagin Reviewed-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima --- net/core/sock.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/net/core/sock.c b/net/core/sock.c index 083d438d8b6f..a9391cb796a2 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -3830,9 +3830,6 @@ void sk_common_release(struct sock *sk) =20 sk->sk_prot->unhash(sk); =20 - if (sk->sk_socket) - sk->sk_socket->sk =3D NULL; - /* * In this point socket cannot receive new packets, but it is possible * that some packets are in flight because some CPU runs receiver and --=20 2.39.5