Commit 25a466eb authored Feb 15, 2025 by Ignat Korchagin Committed by Dong Chenchen Feb 15, 2025

net: inet: do not leave a dangling sk pointer in inet_create()

stable inclusion
from stable-v5.10.231
commit 2bc34d8c8898ae9fddf4612501aabb22d76c2b2c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPL
CVE: CVE-2024-56601

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2bc34d8c8898ae9fddf4612501aabb22d76c2b2c



--------------------------------

[ Upstream commit 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff ]

sock_init_data() attaches the allocated sk object to the provided sock
object. If inet_create() fails later, the sk object is freed, but the
sock object retains the dangling pointer, which may create use-after-free
later.

Clear the sk pointer in the sock object on error.

Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241014153808.51894-7-ignat@cloudflare.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com>

parent 83b361e2

net/ipv4/af_inet.c

+10 −12

Original line number	Diff line number	Diff line
		@@ -373,32 +373,30 @@ static int inet_create(struct net net, struct socket sock, int protocol,
		inet->inet_sport = htons(inet->inet_num);
		/* Add to protocol hash chains. */
		err = sk->sk_prot->hash(sk);
		if (err) {
		sk_common_release(sk);
		goto out;
		}
		if (err)
		goto out_sk_release;
		}

		if (sk->sk_prot->init) {
		err = sk->sk_prot->init(sk);
		if (err) {
		sk_common_release(sk);
		goto out;
		}
		if (err)
		goto out_sk_release;
		}

		if (!kern) {
		err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk);
		if (err) {
		sk_common_release(sk);
		goto out;
		}
		if (err)
		goto out_sk_release;
		}
		out:
		return err;
		out_rcu_unlock:
		rcu_read_unlock();
		goto out;
		out_sk_release:
		sk_common_release(sk);
		sock->sk = NULL;
		goto out;
		}