Re: [PATCH v1 net] tipc: Fix use-after-free of kernel socket in cleanup_bearer().

[Kuniyuki Iwashima <kuniyu@amazon.com>]

From: Eric Dumazet <edumazet@google.com>
Date: Tue, 26 Nov 2024 11:53:07 +0100
> I think 'kernel sockets' were not refcounted to allow the netns to be removed.
> 
> Otherwise, what would tipc_bearer_stop() be needed ?
> 
> tipc_exit_net(struct net *net)  // can only be called when all refcnt
> have been released
>  -> tipc_net_stop()
>   -> tipc_bearer_stop()
>     -> bearer_disable()
>      -> tipc_udp_disable()
>        -> INIT_WORK(&ub->work, cleanup_bearer); schedule_work(&ub->work);

I noticed tipc_net_stop() waits for all works to be completed by
checking tipc_net(net)->wq_count, but it was decremented a bit
early in the work, so I'll post the following as v2:

---8<---
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 10986b283ac8..ef3d8f71bde5 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -821,9 +821,9 @@ static void cleanup_bearer(struct work_struct *work)
 		kfree_rcu(rcast, rcu);
 	}
 
-	atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
 	dst_cache_destroy(&ub->rcast.dst_cache);
 	udp_tunnel_sock_release(ub->ubsock);
 	synchronize_net();
+	atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
 	kfree(ub);
 }
---8<---