From: Ignat Korchagin Date: Mon, 14 Oct 2024 15:38:07 +0000 (+0100) Subject: net: warn, if pf->create does not clear sock->sk on error X-Git-Tag: v6.13-rc1~135^2~306^2~1 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=48156296a08c615a6baae514096c4b2e543d1157;p=linux.git net: warn, if pf->create does not clear sock->sk on error All pf->create implementations have been fixed now to clear sock->sk on error, when they deallocate the allocated sk object. Put a warning in place to make sure we don't break this promise in the future. Suggested-by: Kuniyuki Iwashima Signed-off-by: Ignat Korchagin Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20241014153808.51894-9-ignat@cloudflare.com Signed-off-by: Jakub Kicinski --- diff --git a/net/socket.c b/net/socket.c index 24b404299015..9a8e4452b9b2 100644 --- a/net/socket.c +++ b/net/socket.c @@ -1576,9 +1576,9 @@ int __sock_create(struct net *net, int family, int type, int protocol, err = pf->create(net, sock, protocol, kern); if (err < 0) { /* ->create should release the allocated sock->sk object on error - * but it may leave the dangling pointer + * and make sure sock->sk is set to NULL to avoid use-after-free */ - sock->sk = NULL; + DEBUG_NET_WARN_ON_ONCE(sock->sk); goto out_module_put; }