]> git.baikalelectronics.ru Git - kernel.git/commit
kcm: Fix use-after-free caused by clonned sockets
authorKirill Tkhai <ktkhai@virtuozzo.com>
Fri, 1 Jun 2018 11:30:38 +0000 (14:30 +0300)
committerDavid S. Miller <davem@davemloft.net>
Fri, 1 Jun 2018 14:28:07 +0000 (10:28 -0400)
commit1ceacd3fe81f3d650aa2916a0b0463756f07f148
tree508a9eb07e8d0720ac07f5f36b534de880a15769
parent2612d9ab13e7568a551816af52a6224c55fee812
kcm: Fix use-after-free caused by clonned sockets

(resend for properly queueing in patchwork)

kcm_clone() creates kernel socket, which does not take net counter.
Thus, the net may die before the socket is completely destructed,
i.e. kcm_exit_net() is executed before kcm_done().

Reported-by: syzbot+5f1a04e374a635efc426@syzkaller.appspotmail.com
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/kcm/kcmsock.c