From: Jakub Kicinski Date: Wed, 16 Oct 2024 01:43:11 +0000 (-0700) Subject: Merge branch 'do-not-leave-dangling-sk-pointers-in-pf-create-functions' X-Git-Tag: microblaze-v6.16~599^2~306 X-Git-Url: http://git.monstr.eu/?a=commitdiff_plain;h=2d859aff775d;p=linux-2.6-microblaze.git Merge branch 'do-not-leave-dangling-sk-pointers-in-pf-create-functions' Ignat Korchagin says: ==================== do not leave dangling sk pointers in pf->create functions Some protocol family create() implementations have an error path after allocating the sk object and calling sock_init_data(). sock_init_data() attaches the allocated sk object to the sock object, provided by the caller. If the create() implementation errors out after calling sock_init_data(), it releases the allocated sk object, but the caller ends up having a dangling sk pointer in its sock object on return. Subsequent manipulations on this sock object may try to access the sk pointer, because it is not NULL thus creating a use-after-free scenario. We have implemented a stable hotfix in commit 631083143315 ("net: explicitly clear the sk pointer, when pf->create fails"), but this series aims to fix it properly by going through each of the pf->create() implementations and making sure they all don't return a sock object with a dangling pointer on error. ==================== Link: https://patch.msgid.link/20241014153808.51894-1-ignat@cloudflare.com Signed-off-by: Jakub Kicinski --- 2d859aff775df5486667aa895a7e4b9c2e98e348