[PATCH] kcm: Fix socket use-after-free in kcm_unattach()

[Wentao Liang]

In the unreserved path of kcm_unattach(), the reference held by the
psock on the underlying TCP socket is dropped with sock_put() before
the socket file is released with fput(csk->sk_socket->file) and before
release_sock() is called at the end of the function. If that was the
last reference on the socket, both uses access freed memory.

Drop the socket reference only after the last use of the socket: move
the fput() before the sock_put() and release the socket lock before
dropping the final reference.

Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 net/kcm/kcmsock.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 3912e75079f5..b3838a19f0a7 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1457,9 +1457,11 @@ static void kcm_unattach(struct kcm_psock *psock)
 		mux->psocks_cnt--;
 		spin_unlock_bh(&mux->lock);
 
-		sock_put(csk);
 		fput(csk->sk_socket->file);
 		kmem_cache_free(kcm_psockp, psock);
+		release_sock(csk);
+		sock_put(csk);
+		return;
 	}
 
 	release_sock(csk);
-- 
2.34.1