Re: [PATCH net] tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

[Daehyeon Ko]

Hi Tung,

Thanks for reproducing and testing. Decoded with scripts/decode_stacktrace.sh
(line numbers are current mainline net/tipc/socket.c / net/core/sock.c /
net/socket.c):

BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
Write of size 8 at addr ffff8880047cdc38 by task init/1
Call Trace:
 lock_sock_nested (include/linux/instrumented.h:112 net/core/sock.c:3839)
 tipc_release (include/net/sock.h:1713 net/tipc/socket.c:638)   // lock_sock(sk)
 __sock_release (net/socket.c:710)
 sock_close (net/socket.c:1501)
 __fput (fs/file_table.c:512)

Allocated by task 1:
 sk_alloc (net/core/sock.c:2308)
 tipc_sk_create (net/tipc/socket.c:487)   // sk = sk_alloc(...)
 tipc_accept (net/tipc/socket.c:2744)
 do_accept (net/socket.c:2034)

Freed by task 1:
 __sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
 tipc_sk_create (net/tipc/socket.c:504)   // sk_free(sk) on the tipc_sk_insert() failure path
 tipc_accept (net/tipc/socket.c:2744)
 do_accept (net/socket.c:2034)

So the same sk is allocated at socket.c:487, freed at socket.c:504 (the
sk_free() right before the line this patch adds), and then written at
socket.c:638 (lock_sock()) from tipc_release() on the accept() fput cleanup.

Thanks,
Daehyeon