Commit eb7f54b9 authored Jun 01, 2018 by Kirill Tkhai Committed by David S. Miller Jun 01, 2018

kcm: Fix use-after-free caused by clonned sockets



(resend for properly queueing in patchwork)

kcm_clone() creates kernel socket, which does not take net counter.
Thus, the net may die before the socket is completely destructed,
i.e. kcm_exit_net() is executed before kcm_done().

Reported-by:  <syzbot+5f1a04e374a635efc426@syzkaller.appspotmail.com>
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 664088f8

net/kcm/kcmsock.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1671,7 +1671,7 @@ static struct file kcm_clone(struct socket osock)
		__module_get(newsock->ops->owner);

		newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
		&kcm_proto, true);
		&kcm_proto, false);
		if (!newsk) {
		sock_release(newsock);
		return ERR_PTR(-ENOMEM);

Admin message