On Thu, Jul 9, 2020 at 8:26 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> The sock counting (sock_update_netprioidx() and sock_update_classid())
> was missing from pidfd's implementation of received fd installation. Add
> a call to the new __receive_sock() helper.
[...]
> diff --git a/kernel/pid.c b/kernel/pid.c
[...]
> @@ -642,10 +643,12 @@ static int pidfd_getfd(struct pid *pid, int fd)
> }
>
> ret = get_unused_fd_flags(O_CLOEXEC);
> - if (ret < 0)
> + if (ret < 0) {
> fput(file);
> - else
> + } else {
> fd_install(ret, file);
> + __receive_sock(file);
> + }
__receive_sock() has to be before fd_install(), otherwise `file` can
be a dangling pointer.
