From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH 1/2] dccp: Unlock sock before calling sk_free() Date: Thu, 02 Mar 2017 13:59:20 -0800 (PST) Message-ID: <20170302.135920.357751469126889997.davem@davemloft.net> References: <20170301193508.25760-1-acme@kernel.org> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, acme@redhat.com, xiyou.wangcong@gmail.com, edumazet@google.com, gerrit@erg.abdn.ac.uk, tglx@linutronix.de To: acme@kernel.org Return-path: Received: from shards.monkeyblade.net ([184.105.139.130]:39014 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751542AbdCBWJQ (ORCPT ); Thu, 2 Mar 2017 17:09:16 -0500 In-Reply-To: <20170301193508.25760-1-acme@kernel.org> Sender: netdev-owner@vger.kernel.org List-ID: From: Arnaldo Carvalho de Melo Date: Wed, 1 Mar 2017 16:35:07 -0300 > From: Arnaldo Carvalho de Melo > > The code where sk_clone() came from created a new socket and locked it, > but then, on the error path didn't unlock it. > > This problem stayed there for a long while, till b0691c8ee7c2 ("net: > Unlock sock before calling sk_free()") fixed it, but unfortunately the > callers of sk_clone() (now sk_clone_locked()) were not audited and the > one in dccp_create_openreq_child() remained. > > Now in the age of the syskaller fuzzer, this was finally uncovered, as > reported by Dmitry: ... > Fix it just like was done by b0691c8ee7c2 ("net: Unlock sock before calling > sk_free()"). > > Reported-by: Dmitry Vyukov > Cc: Cong Wang > Cc: Eric Dumazet > Cc: Gerrit Renker > Cc: Thomas Gleixner > Link: http://lkml.kernel.org/r/20170301153510.GE15145@kernel.org > Signed-off-by: Arnaldo Carvalho de Melo Applied and queued up for -stable.