[PATCH net v3] tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

[PATCH net v3] tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

[Daehyeon Ko]

When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()
returns non-zero), its error path frees the sk with sk_free() but leaves
sock->sk pointing at the freed object:

	if (tipc_sk_insert(tsk)) {
		sk_free(sk);
		pr_warn("Socket create failed; port number exhausted\n");
		return -EINVAL;
	}

This is harmless for plain socket(): the syscall layer clears sock->ops
before releasing, so tipc_release() is never called. It is not harmless
on the accept() path. tipc_accept() creates the pre-allocated child
socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves
new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then
fput()s the new file, so __sock_release() -> tipc_release() runs
lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the
sk_lock spinlock.

tipc_release() already guards this exact "failed accept() releases a
pre-allocated child" case with "if (sk == NULL) return 0;", but the
guard is bypassed because tipc_sk_create() left sock->sk non-NULL
(dangling) rather than NULL.

Clear sock->sk on the failed-insert path so the existing tipc_release()
NULL check fires and the use-after-free is avoided.

The tipc_sk_insert() failure is reached when the per-netns socket
rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M
elements) -- i.e. once a netns holds ~2M TIPC sockets every insert
returns -E2BIG.

  BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
  Write of size 8 at addr ffff8880047cdc38 by task init/1
   lock_sock_nested (net/core/sock.c:3839)
   tipc_release (net/tipc/socket.c:638)
   __sock_release (net/socket.c:710)
   sock_close (net/socket.c:1501)
   __fput (fs/file_table.c:512)
  Allocated by task 1:
   sk_alloc (net/core/sock.c:2308)
   tipc_sk_create (net/tipc/socket.c:487)
   tipc_accept (net/tipc/socket.c:2744)
   do_accept (net/socket.c:2034)
  Freed by task 1:
   __sk_destruct (net/core/sock.c:2391)
   tipc_sk_create (net/tipc/socket.c:504)
   tipc_accept (net/tipc/socket.c:2744)
   do_accept (net/socket.c:2034)

Fixes: 00aff3590fc0 ("net: tipc: fix possible refcount leak in tipc_sk_create()")
Cc: stable@vger.kernel.org
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Reviewed-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
v3: correct the Fixes: tag to 00aff3590fc0 ("net: tipc: fix possible
    refcount leak in tipc_sk_create()") -- that commit added the sk_free()
    on the insert-failure path; before it the path leaked sk rather than
    freeing it, so the use-after-free only exists since then (v5.19+).
    Thanks Breno. Collect Reviewed-by from Tung and Breno. No code change.
v2: https://lore.kernel.org/netdev/20260713082342.3803379-1-4ncienth@gmail.com/
v1: https://lore.kernel.org/netdev/20260710014440.2055584-1-4ncienth@gmail.com/

 net/tipc/socket.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e564341e0216..55e695748332 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -502,6 +502,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
 	tipc_set_sk_state(sk, TIPC_OPEN);
 	if (tipc_sk_insert(tsk)) {
 		sk_free(sk);
+		sock->sk = NULL;
 		pr_warn("Socket create failed; port number exhausted\n");
 		return -EINVAL;
 	}
-- 
2.54.0

Re: [PATCH net v3] tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

[Simon Horman]

On Tue, Jul 14, 2026 at 10:19:39PM +0900, Daehyeon Ko wrote:
> When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()
> returns non-zero), its error path frees the sk with sk_free() but leaves
> sock->sk pointing at the freed object:
> 
> 	if (tipc_sk_insert(tsk)) {
> 		sk_free(sk);
> 		pr_warn("Socket create failed; port number exhausted\n");
> 		return -EINVAL;
> 	}
> 
> This is harmless for plain socket(): the syscall layer clears sock->ops
> before releasing, so tipc_release() is never called. It is not harmless
> on the accept() path. tipc_accept() creates the pre-allocated child
> socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves
> new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then
> fput()s the new file, so __sock_release() -> tipc_release() runs
> lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the
> sk_lock spinlock.
> 
> tipc_release() already guards this exact "failed accept() releases a
> pre-allocated child" case with "if (sk == NULL) return 0;", but the
> guard is bypassed because tipc_sk_create() left sock->sk non-NULL
> (dangling) rather than NULL.
> 
> Clear sock->sk on the failed-insert path so the existing tipc_release()
> NULL check fires and the use-after-free is avoided.
> 
> The tipc_sk_insert() failure is reached when the per-netns socket
> rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M
> elements) -- i.e. once a netns holds ~2M TIPC sockets every insert
> returns -E2BIG.
> 
>   BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
>   Write of size 8 at addr ffff8880047cdc38 by task init/1
>    lock_sock_nested (net/core/sock.c:3839)
>    tipc_release (net/tipc/socket.c:638)
>    __sock_release (net/socket.c:710)
>    sock_close (net/socket.c:1501)
>    __fput (fs/file_table.c:512)
>   Allocated by task 1:
>    sk_alloc (net/core/sock.c:2308)
>    tipc_sk_create (net/tipc/socket.c:487)
>    tipc_accept (net/tipc/socket.c:2744)
>    do_accept (net/socket.c:2034)
>   Freed by task 1:
>    __sk_destruct (net/core/sock.c:2391)
>    tipc_sk_create (net/tipc/socket.c:504)
>    tipc_accept (net/tipc/socket.c:2744)
>    do_accept (net/socket.c:2034)
> 
> Fixes: 00aff3590fc0 ("net: tipc: fix possible refcount leak in tipc_sk_create()")
> Cc: stable@vger.kernel.org
> Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
> Reviewed-by: Breno Leitao <leitao@debian.org>
> Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
> ---
> v3: correct the Fixes: tag to 00aff3590fc0 ("net: tipc: fix possible
>     refcount leak in tipc_sk_create()") -- that commit added the sk_free()
>     on the insert-failure path; before it the path leaked sk rather than
>     freeing it, so the use-after-free only exists since then (v5.19+).
>     Thanks Breno. Collect Reviewed-by from Tung and Breno. No code change.
> v2: https://lore.kernel.org/netdev/20260713082342.3803379-1-4ncienth@gmail.com/
> v1: https://lore.kernel.org/netdev/20260710014440.2055584-1-4ncienth@gmail.com/

Reviewed-by: Simon Horman <horms@kernel.org>