Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | From | Hillf Danton <> | Subject | Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in __unix_gc | Date | Sat, 10 Feb 2024 14:35:25 +0800 |
| |
On Fri, 09 Feb 2024 06:57:17 -0800 > HEAD commit: e7689879d14e ethtool: do not use rtnl in ethnl_default_dum.. > git tree: net-next > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=165f9cec180000
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main
--- x/net/unix/garbage.c +++ y/net/unix/garbage.c @@ -119,6 +119,7 @@ void unix_inflight(struct user_struct *u if (!u->inflight) { WARN_ON_ONCE(!list_empty(&u->link)); list_add_tail(&u->link, &gc_inflight_list); + sock_hold(&u->sk); } else { WARN_ON_ONCE(list_empty(&u->link)); } @@ -350,6 +351,11 @@ static void __unix_gc(struct work_struct } #endif + list_for_each_entry_safe(u, next, &gc_candidates, link) { + list_del(&u->link); + sock_put(&u->sk); + } + spin_lock(&unix_gc_lock); /* All candidates should have been detached by now. */ --
| ![\](/images/icornerr.gif) |