Patch "net: inet: do not leave a dangling sk pointer in inet_create()" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: inet: do not leave a dangling sk pointer in inet_create()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-inet-do-not-leave-a-dangling-sk-pointer-in-inet_.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d47a6235dc137bddfc93a4e7a9a11ee1ac7d4bff
Author: Ignat Korchagin <ignat@xxxxxxxxxxxxxx>
Date:   Mon Oct 14 16:38:05 2024 +0100

    net: inet: do not leave a dangling sk pointer in inet_create()
    
    [ Upstream commit 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff ]
    
    sock_init_data() attaches the allocated sk object to the provided sock
    object. If inet_create() fails later, the sk object is freed, but the
    sock object retains the dangling pointer, which may create use-after-free
    later.
    
    Clear the sk pointer in the sock object on error.
    
    Signed-off-by: Ignat Korchagin <ignat@xxxxxxxxxxxxxx>
    Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Link: https://patch.msgid.link/20241014153808.51894-7-ignat@xxxxxxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index cc013be9b02c4..4f3c932e37ed5 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -371,32 +371,30 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
 		inet->inet_sport = htons(inet->inet_num);
 		/* Add to protocol hash chains. */
 		err = sk->sk_prot->hash(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 
 	if (sk->sk_prot->init) {
 		err = sk->sk_prot->init(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 
 	if (!kern) {
 		err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk);
-		if (err) {
-			sk_common_release(sk);
-			goto out;
-		}
+		if (err)
+			goto out_sk_release;
 	}
 out:
 	return err;
 out_rcu_unlock:
 	rcu_read_unlock();
 	goto out;
+out_sk_release:
+	sk_common_release(sk);
+	sock->sk = NULL;
+	goto out;
 }