summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKirill Tkhai <ktkhai@virtuozzo.com>2018-06-01 14:30:38 +0300
committerDavid S. Miller <davem@davemloft.net>2018-06-01 10:28:07 -0400
commiteb7f54b90bd8f469834c5e86dcf72ebf9a629811 (patch)
tree508a9eb07e8d0720ac07f5f36b534de880a15769
parent664088f8d68178809b848ca450f2797efb34e8e7 (diff)
kcm: Fix use-after-free caused by clonned sockets
(resend for properly queueing in patchwork) kcm_clone() creates kernel socket, which does not take net counter. Thus, the net may die before the socket is completely destructed, i.e. kcm_exit_net() is executed before kcm_done(). Reported-by: syzbot+5f1a04e374a635efc426@syzkaller.appspotmail.com Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/kcm/kcmsock.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index dc76bc346829..d3601d421571 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1671,7 +1671,7 @@ static struct file *kcm_clone(struct socket *osock)
__module_get(newsock->ops->owner);
newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
- &kcm_proto, true);
+ &kcm_proto, false);
if (!newsk) {
sock_release(newsock);
return ERR_PTR(-ENOMEM);