From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64DDE1DFDE for ; Fri, 10 Jul 2026 01:44:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783647899; cv=none; b=Jyvg8zGWSyNTHTEr/RnyJ+Hp2oN0O2Sdix825UVhY6+pa90tzCkMx7Z1vUIVkbj1J0HSNh4rvyySPOzaxke/Se621qwsG6CrPvHR+7NVv11jCzverhoZQhsZ0wcdBZff3+wQ6OizG6xSzhagycT+DmT0uvpblb3EFh4SdJzf+DE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783647899; c=relaxed/simple; bh=fddwZMEJzG3D8cZDEDw7rYgZv9IFMpJGUX4crZ0R5Go=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ShfIX0U5OugC4jbWWsvoUO4EvrChIn06X5oYZiA9AnWKQf4ydos3bq8Lg7JHiLKzaJ0wZlDwBrNztqmiSx7UOdUZS+S3dWyUxJX4KOs59Vy3nQjT8NtHisdE7fH4mk2Lxp0omPw4ZIK4xmTiKpdncRV7SLMqq+UBqqHsvaZZGB8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kCSihxFT; arc=none smtp.client-ip=209.85.210.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kCSihxFT" Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-84867f07d63so394498b3a.2 for ; Thu, 09 Jul 2026 18:44:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783647898; x=1784252698; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=3UTPv+hJX2QLGxws8LgGW5Meix2PpanRSv1dLaDtFYQ=; b=kCSihxFT3uw/+JOBONin1YIfwPhRdYIJkc5FqsEmPSVdAaJ4bF3OKDmMvYgZa1qcXL ufNGDUB4oqNgYZ3YFQr4MblenAVDPVB+kTlG3buPOvQfP2k36zkn5UTR3KeqOyrnbkNj UKrY4qwkvCLzIOjp8o+Wcl6pHEMFzGzbN7yrX1I/xJQRZboOGruy9B6Z4RdSJbfIzuMN w27nwEKjpCKAUSqPp5VJqQ8lSshO5voOg+bUDi4o9e7JxPI4TE3eahZkNr7GqN9rWqQq eChQVh/8pfVdzqwUvVkf1jKdAN2oIHAliIXXncZHntl1rJdxDtG03Pp0wHRbLGbRqTbd mgaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783647898; x=1784252698; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3UTPv+hJX2QLGxws8LgGW5Meix2PpanRSv1dLaDtFYQ=; b=aorwhQOSCEMSTUpfDDNSKaGNdK1E6lq+yJYc2S6xpfvDCWVtZCKKKOipKyccKWlqYL 2Bl1EOTkASZSu9+PFOOBOJBEY4mH9+goEwJT8/Ytj5l/gZDa6IRD4GNbBXZNLhdXBEAT GXjcSvShFxXJWI2tGzAq+DIUHBzrNPUHv+GPQP1SpMdva2oIk3NphDoyDW2QrYNTrQge VTif6reakOYjkvltUSXkpp1dVTlg7vlcpp/xADrrBg2ktrqHK573XKi6w+SvFpNogIl2 uQpqMUpD7hWsvZrqQyJfIWembxZ3zBcvsqOC4OCEfQYwxXUod0kCXLPZSmeIvyKzCkyX yzPw== X-Forwarded-Encrypted: i=1; AHgh+RrM1LC5UOVKDAiuWZ/lC0pivu3yrOfsf6mTaLg5AlaHpjU7qxcdZmtJ7ELC6eqSqOG6ws919fuev2CXv2A=@vger.kernel.org X-Gm-Message-State: AOJu0YxjjO+QRP2YNad4wKALk6wGSsp7Vhon1e5s2xd8j36S+NtSTGCp 5omK3AFEd+X7UysA22kcSloqYpNfijACtzdemxL6efOK61CjNQJ+XojU X-Gm-Gg: AfdE7cmx71lTDKBX1X/4TJp9LUCclI13aKBUBUfkvK8t59M0ikkJXTWzLHYeS6RP6Ph 6z29AJhk4JLhdk4+HAW51RAF3jrEgHOcWeqE1ytbN/DBIj07J48nspyDzIV2d+7jt+FcUAUBn39 rhCnSsGkm6Pb1VsscWXfhWWdNM3SBTyJFf2aNEkys73GrV9m6jXaDh6hYw/XjhQUDWKdErK2NpW bUqEpEiEtK3aN8Mar4azUyPQzOhuFnUjOxxVHxO9F889MT8or1Dvh/joxjgsUN5PNUPCDV3gdU9 U9sdaHxWAtOwYOQwW2F1qLoEtPdto3WVmARua2AUbmUSekvYfRjIkb3Lm21vxZwXL3oCCatRxtn 1lZlxQRHEJaLTUxRy2OwsJahbVyLY2LcYQ7Uma5pej/CCzVlhp3WltbiNvsnPcNgauEYUppbQNC eR+EUWM+rJbPGEYC5nuofoXMgC X-Received: by 2002:a05:6a00:2e24:b0:847:b16b:46d9 with SMTP id d2e1a72fcca58-84843248513mr8521769b3a.34.1783647897749; Thu, 09 Jul 2026 18:44:57 -0700 (PDT) Received: from ancienth-X870E-Nova-WiFi ([125.186.72.2]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84856d5d661sm2055607b3a.35.2026.07.09.18.44.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Jul 2026 18:44:57 -0700 (PDT) From: Daehyeon Ko <4ncienth@gmail.com> To: netdev@vger.kernel.org Cc: Jon Maloy , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , tipc-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org, Daehyeon Ko <4ncienth@gmail.com>, stable@vger.kernel.org Subject: [PATCH net] tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Date: Fri, 10 Jul 2026 10:44:40 +0900 Message-ID: <20260710014440.2055584-1-4ncienth@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When tipc_sk_create() fails to insert the new socket (tipc_sk_insert() returns non-zero), its error path frees the sk with sk_free() but leaves sock->sk pointing at the freed object: if (tipc_sk_insert(tsk)) { sk_free(sk); pr_warn("Socket create failed; port number exhausted\n"); return -EINVAL; } This is harmless for plain socket(): the syscall layer clears sock->ops before releasing, so tipc_release() is never called. It is not harmless on the accept() path. tipc_accept() creates the pre-allocated child socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then fput()s the new file, so __sock_release() -> tipc_release() runs lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the sk_lock spinlock. tipc_release() already guards this exact "failed accept() releases a pre-allocated child" case with "if (sk == NULL) return 0;", but the guard is bypassed because tipc_sk_create() left sock->sk non-NULL (dangling) rather than NULL. Clear sock->sk on the failed-insert path so the existing tipc_release() NULL check fires and the use-after-free is avoided. The tipc_sk_insert() failure is reached when the per-netns socket rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M elements) -- i.e. once a netns holds ~2M TIPC sockets every insert returns -E2BIG. BUG: KASAN: slab-use-after-free in lock_sock_nested+0x98/0x150 Write of size 8 at addr ffff8880047cdc38 by task init/1 lock_sock_nested+0x98/0x150 tipc_release+0xa4/0x7a0 __sock_release+0x61/0x120 sock_close+0x10/0x20 __fput+0x1d6/0x490 Allocated by task 1: sk_alloc+0x2b/0x380 tipc_sk_create+0x82/0xb90 tipc_accept+0x14c/0x650 Freed by task 1: __sk_destruct+0x22d/0x2d0 tipc_sk_create+0x7b8/0xb90 tipc_accept+0x14c/0x650 do_accept+0x1d2/0x2a0 Fixes: 07f6c4bc048a ("tipc: convert tipc reference table to use generic rhashtable") Cc: stable@vger.kernel.org Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> --- This was reported to security@kernel.org (Cc: the TIPC maintainer) with no response; posting the fix directly to netdev as it is a straightforward one-line fix. Full C reproducer available on request. net/tipc/socket.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index e564341e0216..55e695748332 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -502,6 +502,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock, tipc_set_sk_state(sk, TIPC_OPEN); if (tipc_sk_insert(tsk)) { sk_free(sk); + sock->sk = NULL; pr_warn("Socket create failed; port number exhausted\n"); return -EINVAL; } -- 2.54.0