lkml.org 
[lkml]   [2024]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRe: [syzbot] [net?] KASAN: slab-use-after-free Read in unix_del_edges
Date
On Fri, 19 Apr 2024 02:39:21 -0700
> syzbot found the following issue on:
>
> HEAD commit: 7b4f2bc91c15 Add linux-next specific files for 20240418
> git tree: linux-next
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=128b1d53180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 7b4f2bc91c15

--- x/net/unix/garbage.c
+++ y/net/unix/garbage.c
@@ -205,6 +205,7 @@ void unix_add_edges(struct scm_fp_list *
edge = fpl->edges + i++;
edge->predecessor = inflight;
edge->successor = receiver;
+ sock_hold((struct sock *)receiver);

unix_add_edge(fpl, edge);
} while (i < fpl->count_unix);
@@ -225,6 +226,7 @@ void unix_del_edges(struct scm_fp_list *
{
struct unix_sock *receiver;
int i = 0;
+ int j;

spin_lock(&unix_gc_lock);

@@ -246,6 +248,12 @@ out:
spin_unlock(&unix_gc_lock);

fpl->inflight = false;
+
+ for (j = 0; j < i; j++) {
+ struct unix_edge *edge = fpl->edges + j;
+
+ sock_put((struct sock *)(edge->successor));
+ }
}

void unix_update_edges(struct unix_sock *receiver)
--
\
 
 \ /
  Last update: 2024-05-27 16:47    [W:0.625 / U:0.376 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site