netdev - Re: [PATCH v2 net] net: Fix null-ptr-deref by sock_lock_init_class_and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250407155204.16501-1-kuniyu@amazon.com>
Date: Mon, 7 Apr 2025 08:52:02 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <edumazet@...gle.com>
CC: <davem@...emloft.net>, <ematsumiya@...e.de>, <horms@...nel.org>,
	<kuba@...nel.org>, <kuni1840@...il.com>, <kuniyu@...zon.com>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>, <peterz@...radead.org>,
	<sfrench@...ba.org>, <stable@...r.kernel.org>, <wangzhaolong1@...wei.com>,
	<willemb@...gle.com>
Subject: Re: [PATCH v2 net] net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.

From: Eric Dumazet <edumazet@...gle.com>
Date: Mon, 7 Apr 2025 13:21:11 +0200
> > diff --git a/net/core/sock.c b/net/core/sock.c
> > index 323892066def..d426c5f8e20f 100644
> > --- a/net/core/sock.c
> > +++ b/net/core/sock.c
> > @@ -2130,6 +2130,8 @@ int sk_getsockopt(struct sock *sk, int level, int optname,
> >   */
> >  static inline void sock_lock_init(struct sock *sk)
> >  {
> > +       sk_owner_clear(sk);
> > +
> >         if (sk->sk_kern_sock)
> >                 sock_lock_init_class_and_name(
> >                         sk,
> > @@ -2324,6 +2326,8 @@ static void __sk_destruct(struct rcu_head *head)
> >                 __netns_tracker_free(net, &sk->ns_tracker, false);
> >                 net_passive_dec(net);
> >         }
> > +
> > +       sk_owner_put(sk);
> 
> I am not convinced that the socket lock can be used after this point,
> now or in the future.
> 
> >         sk_prot_free(sk->sk_prot_creator, sk);
> >  }
> 
> Maybe move this in sk_prot_free() instead ?

Makes sense.
Will move sk_owner_put() to sk_prot_free() in v3.

Thanks!


> 
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 323892066def..9ab149d1584c 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -2226,6 +2226,9 @@ static void sk_prot_free(struct proto *prot,
> struct sock *sk)
>         cgroup_sk_free(&sk->sk_cgrp_data);
>         mem_cgroup_sk_free(sk);
>         security_sk_free(sk);
> +
> +       sk_owner_put(sk);
> +
>         if (slab != NULL)
>                 kmem_cache_free(slab, sk);
>         else