RE: [PATCH net] tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

[Tung Quang Nguyen]

>Subject: Re: [PATCH net] tipc: clear sock->sk on the failed-insert path in
>tipc_sk_create()
>
>Hi Tung,
>
>Thanks for reproducing and testing. Decoded with
>scripts/decode_stacktrace.sh (line numbers are current mainline
>net/tipc/socket.c / net/core/sock.c /
>net/socket.c):
>
>BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
>Write of size 8 at addr ffff8880047cdc38 by task init/1 Call Trace:
> lock_sock_nested (include/linux/instrumented.h:112 net/core/sock.c:3839)
> tipc_release (include/net/sock.h:1713 net/tipc/socket.c:638)   // lock_sock(sk)
> __sock_release (net/socket.c:710)
> sock_close (net/socket.c:1501)
> __fput (fs/file_table.c:512)
>
>Allocated by task 1:
> sk_alloc (net/core/sock.c:2308)
> tipc_sk_create (net/tipc/socket.c:487)   // sk = sk_alloc(...)
> tipc_accept (net/tipc/socket.c:2744)
> do_accept (net/socket.c:2034)
>
>Freed by task 1:
> __sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
> tipc_sk_create (net/tipc/socket.c:504)   // sk_free(sk) on the tipc_sk_insert()
>failure path
> tipc_accept (net/tipc/socket.c:2744)
> do_accept (net/socket.c:2034)
>
>So the same sk is allocated at socket.c:487, freed at socket.c:504 (the
>sk_free() right before the line this patch adds), and then written at
>socket.c:638 (lock_sock()) from tipc_release() on the accept() fput cleanup.

I meant to say please send V2 with above decoded stack trace in your changelog.

>
>Thanks,
>Daehyeon