Re: [PATCH v2 net] net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.

[Kuniyuki Iwashima <kuniyu@amazon.com>]

From: Eric Dumazet <edumazet@google.com>
Date: Mon, 7 Apr 2025 13:21:11 +0200
> > diff --git a/net/core/sock.c b/net/core/sock.c
> > index 323892066def..d426c5f8e20f 100644
> > --- a/net/core/sock.c
> > +++ b/net/core/sock.c
> > @@ -2130,6 +2130,8 @@ int sk_getsockopt(struct sock *sk, int level, int optname,
> >   */
> >  static inline void sock_lock_init(struct sock *sk)
> >  {
> > +       sk_owner_clear(sk);
> > +
> >         if (sk->sk_kern_sock)
> >                 sock_lock_init_class_and_name(
> >                         sk,
> > @@ -2324,6 +2326,8 @@ static void __sk_destruct(struct rcu_head *head)
> >                 __netns_tracker_free(net, &sk->ns_tracker, false);
> >                 net_passive_dec(net);
> >         }
> > +
> > +       sk_owner_put(sk);
> 
> I am not convinced that the socket lock can be used after this point,
> now or in the future.
> 
> >         sk_prot_free(sk->sk_prot_creator, sk);
> >  }
> 
> Maybe move this in sk_prot_free() instead ?

Makes sense.
Will move sk_owner_put() to sk_prot_free() in v3.

Thanks!


> 
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 323892066def..9ab149d1584c 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -2226,6 +2226,9 @@ static void sk_prot_free(struct proto *prot,
> struct sock *sk)
>         cgroup_sk_free(&sk->sk_cgrp_data);
>         mem_cgroup_sk_free(sk);
>         security_sk_free(sk);
> +
> +       sk_owner_put(sk);
> +
>         if (slab != NULL)
>                 kmem_cache_free(slab, sk);
>         else