From: Ignat Korchagin <ignat@cloudflare•com>
To: "David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Jakub Kicinski <kuba@kernel•org>, Paolo Abeni <pabeni@redhat•com>,
netdev@vger•kernel.org, linux-kernel@vger•kernel.org,
Marcel Holtmann <marcel@holtmann•org>,
Johan Hedberg <johan.hedberg@gmail•com>,
Luiz Augusto von Dentz <luiz.dentz@gmail•com>,
Oliver Hartkopp <socketcan@hartkopp•net>,
Marc Kleine-Budde <mkl@pengutronix•de>,
Alexander Aring <alex.aring@gmail•com>,
Stefan Schmidt <stefan@datenfreihafen•org>,
Miquel Raynal <miquel.raynal@bootlin•com>,
David Ahern <dsahern@kernel•org>,
Willem de Bruijn <willemdebruijn.kernel@gmail•com>,
linux-bluetooth@vger•kernel.org, linux-can@vger•kernel.org,
linux-wpan@vger•kernel.org
Cc: kernel-team@cloudflare•com, kuniyu@amazon•com,
alibuda@linux•alibaba.com, Ignat Korchagin <ignat@cloudflare•com>
Subject: [PATCH v2 5/8] net: af_can: do not leave a dangling sk pointer in can_create()
Date: Mon, 7 Oct 2024 22:34:59 +0100 [thread overview]
Message-ID: <20241007213502.28183-6-ignat@cloudflare.com> (raw)
In-Reply-To: <20241007213502.28183-1-ignat@cloudflare.com>
On error can_create() frees the allocated sk object, but sock_init_data()
has already attached it to the provided sock object. This will leave a
dangling sk pointer in the sock object and may cause use-after-free later.
Signed-off-by: Ignat Korchagin <ignat@cloudflare•com>
---
net/can/af_can.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 707576eeeb58..01f3fbb3b67d 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -171,6 +171,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol,
/* release sk on errors */
sock_orphan(sk);
sock_put(sk);
+ sock->sk = NULL;
}
errout:
--
2.39.5
next prev parent reply other threads:[~2024-10-07 21:35 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-07 21:34 [PATCH v2 0/8] do not leave dangling sk pointers in pf->create functions Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 1/8] net: explicitly clear the sk pointer, when pf->create fails Ignat Korchagin
2024-10-07 21:47 ` Kuniyuki Iwashima
2024-10-08 0:20 ` Jakub Kicinski
2024-10-07 21:34 ` [PATCH v2 2/8] af_packet: avoid erroring out after sock_init_data() in packet_create() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 3/8] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() Ignat Korchagin
2024-10-07 21:34 ` [PATCH v2 4/8] Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() Ignat Korchagin
2024-10-07 21:34 ` Ignat Korchagin [this message]
2024-10-08 2:37 ` [PATCH v2 5/8] net: af_can: do not leave a dangling sk pointer in can_create() Vincent MAILHOL
2024-10-08 6:52 ` Ignat Korchagin
2024-10-07 21:35 ` [PATCH v2 6/8] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() Ignat Korchagin
2024-10-08 8:12 ` Miquel Raynal
2024-10-07 21:35 ` [PATCH v2 7/8] net: inet: do not leave a dangling sk pointer in inet_create() Ignat Korchagin
2024-10-07 21:35 ` [PATCH v2 8/8] inet6: do not leave a dangling sk pointer in inet6_create() Ignat Korchagin
2024-10-07 21:57 ` [PATCH v2 0/8] do not leave dangling sk pointers in pf->create functions Kuniyuki Iwashima
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241007213502.28183-6-ignat@cloudflare.com \
--to=ignat@cloudflare$(echo .)com \
--cc=alex.aring@gmail$(echo .)com \
--cc=alibuda@linux$(echo .)alibaba.com \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@kernel$(echo .)org \
--cc=edumazet@google$(echo .)com \
--cc=johan.hedberg@gmail$(echo .)com \
--cc=kernel-team@cloudflare$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=kuniyu@amazon$(echo .)com \
--cc=linux-bluetooth@vger$(echo .)kernel.org \
--cc=linux-can@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-wpan@vger$(echo .)kernel.org \
--cc=luiz.dentz@gmail$(echo .)com \
--cc=marcel@holtmann$(echo .)org \
--cc=miquel.raynal@bootlin$(echo .)com \
--cc=mkl@pengutronix$(echo .)de \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=socketcan@hartkopp$(echo .)net \
--cc=stefan@datenfreihafen$(echo .)org \
--cc=willemdebruijn.kernel@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox