From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kirill Tkhai Subject: [PATCH net] kcm: Fix use-after-free caused by clonned sockets Date: Fri, 1 Jun 2018 14:30:38 +0300 Message-ID: References: <9f485659-6d6f-9047-b9ad-b0e4084be88d@virtuozzo.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit To: "David S. Miller" , ebiggers@google.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com, tom@quantonium.net, viro@ZenIV.linux.org.uk, Eric Dumazet Return-path: Received: from mail-he1eur01on0130.outbound.protection.outlook.com ([104.47.0.130]:45463 "EHLO EUR01-HE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750795AbeFALar (ORCPT ); Fri, 1 Jun 2018 07:30:47 -0400 In-Reply-To: <9f485659-6d6f-9047-b9ad-b0e4084be88d@virtuozzo.com> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: (resend for properly queueing in patchwork) kcm_clone() creates kernel socket, which does not take net counter. Thus, the net may die before the socket is completely destructed, i.e. kcm_exit_net() is executed before kcm_done(). Reported-by: syzbot+5f1a04e374a635efc426@syzkaller.appspotmail.com Signed-off-by: Kirill Tkhai --- diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index d67734c99027..84b7d5c6fec8 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1671,7 +1671,7 @@ static struct file *kcm_clone(struct socket *osock) __module_get(newsock->ops->owner); newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL, - &kcm_proto, true); + &kcm_proto, false); if (!newsk) { sock_release(newsock); return ERR_PTR(-ENOMEM);