From: Ignat Korchagin <ignat@cloudflare•com>
To: "David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Jakub Kicinski <kuba@kernel•org>, Paolo Abeni <pabeni@redhat•com>,
netdev@vger•kernel.org, linux-kernel@vger•kernel.org,
Marcel Holtmann <marcel@holtmann•org>,
Johan Hedberg <johan.hedberg@gmail•com>,
Luiz Augusto von Dentz <luiz.dentz@gmail•com>,
Oliver Hartkopp <socketcan@hartkopp•net>,
Marc Kleine-Budde <mkl@pengutronix•de>,
Alexander Aring <alex.aring@gmail•com>,
Stefan Schmidt <stefan@datenfreihafen•org>,
Miquel Raynal <miquel.raynal@bootlin•com>,
David Ahern <dsahern@kernel•org>,
Willem de Bruijn <willemdebruijn.kernel@gmail•com>,
linux-bluetooth@vger•kernel.org, linux-can@vger•kernel.org,
linux-wpan@vger•kernel.org
Cc: kernel-team@cloudflare•com, kuniyu@amazon•com,
alibuda@linux•alibaba.com, Ignat Korchagin <ignat@cloudflare•com>
Subject: [PATCH v2 2/8] af_packet: avoid erroring out after sock_init_data() in packet_create()
Date: Mon, 7 Oct 2024 22:34:56 +0100 [thread overview]
Message-ID: <20241007213502.28183-3-ignat@cloudflare.com> (raw)
In-Reply-To: <20241007213502.28183-1-ignat@cloudflare.com>
After sock_init_data() the allocated sk object is attached to the provided
sock object. On error, packet_create() frees the sk object leaving the
dangling pointer in the sock object on return. Some other code may try
to use this pointer and cause use-after-free.
Suggested-by: Eric Dumazet <edumazet@google•com>
Signed-off-by: Ignat Korchagin <ignat@cloudflare•com>
---
net/packet/af_packet.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index a705ec214254..97774bd4b6cb 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3421,17 +3421,17 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
if (sock->type == SOCK_PACKET)
sock->ops = &packet_ops_spkt;
+ po = pkt_sk(sk);
+ err = packet_alloc_pending(po);
+ if (err)
+ goto out_sk_free;
+
sock_init_data(sock, sk);
- po = pkt_sk(sk);
init_completion(&po->skb_completion);
sk->sk_family = PF_PACKET;
po->num = proto;
- err = packet_alloc_pending(po);
- if (err)
- goto out2;
-
packet_cached_dev_reset(po);
sk->sk_destruct = packet_sock_destruct;
@@ -3463,7 +3463,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
sock_prot_inuse_add(net, &packet_proto, 1);
return 0;
-out2:
+out_sk_free:
sk_free(sk);
out:
return err;
--
2.39.5
next prev parent reply other threads:[~2024-10-07 21:35 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-07 21:34 [PATCH v2 0/8] do not leave dangling sk pointers in pf->create functions Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 1/8] net: explicitly clear the sk pointer, when pf->create fails Ignat Korchagin
2024-10-07 21:47 ` Kuniyuki Iwashima
2024-10-08 0:20 ` Jakub Kicinski
2024-10-07 21:34 ` Ignat Korchagin [this message]
2024-10-07 21:34 ` [PATCH v2 3/8] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 4/8] Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 5/8] net: af_can: do not leave a dangling sk pointer in can_create() Ignat Korchagin
2024-10-08 2:37 ` Vincent MAILHOL
2024-10-08 6:52 ` Ignat Korchagin
2024-10-07 21:35 ` [PATCH v2 6/8] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() Ignat Korchagin
2024-10-08 8:12 ` Miquel Raynal
2024-10-07 21:35 ` [PATCH v2 7/8] net: inet: do not leave a dangling sk pointer in inet_create() Ignat Korchagin
2024-10-07 21:35 ` [PATCH v2 8/8] inet6: do not leave a dangling sk pointer in inet6_create() Ignat Korchagin
2024-10-07 21:57 ` [PATCH v2 0/8] do not leave dangling sk pointers in pf->create functions Kuniyuki Iwashima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241007213502.28183-3-ignat@cloudflare.com \
--to=ignat@cloudflare$(echo .)com \
--cc=alex.aring@gmail$(echo .)com \
--cc=alibuda@linux$(echo .)alibaba.com \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@kernel$(echo .)org \
--cc=edumazet@google$(echo .)com \
--cc=johan.hedberg@gmail$(echo .)com \
--cc=kernel-team@cloudflare$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=kuniyu@amazon$(echo .)com \
--cc=linux-bluetooth@vger$(echo .)kernel.org \
--cc=linux-can@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-wpan@vger$(echo .)kernel.org \
--cc=luiz.dentz@gmail$(echo .)com \
--cc=marcel@holtmann$(echo .)org \
--cc=miquel.raynal@bootlin$(echo .)com \
--cc=mkl@pengutronix$(echo .)de \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=socketcan@hartkopp$(echo .)net \
--cc=stefan@datenfreihafen$(echo .)org \
--cc=willemdebruijn.kernel@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox