Re: [PATCH net] llc: call sock_orphan() at release time

[Kuniyuki Iwashima <kuniyu@amazon.com>]

From: Eric Dumazet <edumazet@google.com>
Date: Fri, 26 Jan 2024 16:55:32 +0000
> syzbot reported an interesting trace [1] caused by a stale sk->sk_wq
> pointer in a closed llc socket.
> 
> In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after
> calling proto_ops::release()") Eric Biggers hinted that some protocols
> are missing a sock_orphan(), we need to perform a full audit.
> 
> In net-next, I plan to clear sock->sk from sock_orphan() and
> amend Eric patch to add a warning.
[...]
> 
> Fixes: 43815482370c ("net: sock_def_readable() and friends RCU conversion")
> Reported-and-tested-by: syzbot+32b89eaa102b372ff76d@syzkaller.appspotmail.com
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Eric Biggers <ebiggers@google.com>
> Cc: Kuniyuki Iwashima <kuniyu@amazon.com>

Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>

The plan sounds good to me, thanks!


> ---
>  net/llc/af_llc.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
> index 20551cfb7da6d8dd098c906477895e26c080fe32..fde1140d899efc7ba02e6bc3998cb857ef30df14 100644
> --- a/net/llc/af_llc.c
> +++ b/net/llc/af_llc.c
> @@ -226,6 +226,8 @@ static int llc_ui_release(struct socket *sock)
>  	}
>  	netdev_put(llc->dev, &llc->dev_tracker);
>  	sock_put(sk);
> +	sock_orphan(sk);
> +	sock->sk = NULL;
>  	llc_sk_free(sk);
>  out:
>  	return 0;
> -- 
> 2.43.0.429.g432eaa2c6b-goog