From: Ignat Korchagin <ignat@xxxxxxxxxxxxxx> Date: Mon, 14 Oct 2024 16:38:03 +0100 > On error can_create() frees the allocated sk object, but sock_init_data() > has already attached it to the provided sock object. This will leave a > dangling sk pointer in the sock object and may cause use-after-free later. > > Signed-off-by: Ignat Korchagin <ignat@xxxxxxxxxxxxxx> > Reviewed-by: Vincent Mailhol <mailhol.vincent@xxxxxxxxxx> Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
