diff options
| author | Ignat Korchagin <ignat@cloudflare.com> | 2024-10-14 18:38:07 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-10-16 04:43:08 +0300 |
| commit | 48156296a08c615a6baae514096c4b2e543d1157 (patch) | |
| tree | cc5fc50da0fc291d550d05e000c9028cf4a2dd6c | |
| parent | 9df99c395d0f55fb444ef39f4d6f194ca437d884 (diff) | |
| download | linux-48156296a08c615a6baae514096c4b2e543d1157.tar.xz | |
net: warn, if pf->create does not clear sock->sk on error
All pf->create implementations have been fixed now to clear sock->sk on
error, when they deallocate the allocated sk object.
Put a warning in place to make sure we don't break this promise in the
future.
Suggested-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241014153808.51894-9-ignat@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/socket.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/socket.c b/net/socket.c index 24b404299015..9a8e4452b9b2 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1576,9 +1576,9 @@ int __sock_create(struct net *net, int family, int type, int protocol, err = pf->create(net, sock, protocol, kern); if (err < 0) { /* ->create should release the allocated sock->sk object on error - * but it may leave the dangling pointer + * and make sure sock->sk is set to NULL to avoid use-after-free */ - sock->sk = NULL; + DEBUG_NET_WARN_ON_ONCE(sock->sk); goto out_module_put; } |