Some protocol family create() implementations have an error path after
allocating the sk object and calling sock_init_data(). sock_init_data()
attaches the allocated sk object to the sock object, provided by the
caller.
If the create() implementation errors out after calling sock_init_data(),
it releases the allocated sk object, but the caller ends up having a
dangling sk pointer in its sock object on return. Subsequent manipulations
on this sock object may try to access the sk pointer, because it is not
NULL thus creating a use-after-free scenario.
We have implemented a stable hotfix in commit 631083143315
("net: explicitly clear the sk pointer, when pf->create fails"), but this
series aims to fix it properly by going through each of the pf->create()
implementations and making sure they all don't return a sock object with
a dangling pointer on error.
Changes in V3:
* retargeted the series to net-next
* dropped the hotfix patch, which was merged into net already
* replaced the hotfix code with DEBUG_NET_WARN_ON_ONCE() to catch future
violations
Changes in V2:
* reverted the change introduced in 6cd4a78d962b ("net: do not leave a
dangling sk pointer, when socket creation fails")
* added optional commits to all pf->create implementaions to clear the
sk pointer on error after sock_init_data()
Ignat Korchagin (9):
af_packet: avoid erroring out after sock_init_data() in
packet_create()
Bluetooth: L2CAP: do not leave dangling sk pointer on error in
l2cap_sock_create()
Bluetooth: RFCOMM: avoid leaving dangling sk pointer in
rfcomm_sock_alloc()
net: af_can: do not leave a dangling sk pointer in can_create()
net: ieee802154: do not leave a dangling sk pointer in
ieee802154_create()
net: inet: do not leave a dangling sk pointer in inet_create()
net: inet6: do not leave a dangling sk pointer in inet6_create()
net: warn, if pf->create does not clear sock->sk on error
Revert "net: do not leave a dangling sk pointer, when socket creation
fails"
net/bluetooth/l2cap_sock.c | 1 +
net/bluetooth/rfcomm/sock.c | 10 +++++-----
net/can/af_can.c | 1 +
net/core/sock.c | 3 ---
net/ieee802154/socket.c | 12 +++++++-----
net/ipv4/af_inet.c | 22 ++++++++++------------
net/ipv6/af_inet6.c | 22 ++++++++++------------
net/packet/af_packet.c | 12 ++++++------
net/socket.c | 4 ++--
9 files changed, 42 insertions(+), 45 deletions(-)
--
2.39.5
