• WANG Cong's avatar
    kcm: fix a socket double free · c0338aff
    WANG Cong authored
    Dmitry reported a double free on kcm socket, which could
    be easily reproduced by:
    
    	#include <unistd.h>
    	#include <sys/syscall.h>
    
    	int main()
    	{
    	  int fd = syscall(SYS_socket, 0x29ul, 0x5ul, 0x0ul, 0, 0, 0);
    	  syscall(SYS_ioctl, fd, 0x89e2ul, 0x20a98000ul, 0, 0, 0);
    	  return 0;
    	}
    
    This is because on the error path, after we install
    the new socket file, we call sock_release() to clean
    up the socket, which leaves the fd pointing to a freed
    socket. Fix this by calling sys_close() on that fd
    directly.
    
    Fixes: ab7ac4eb ("kcm: Kernel Connection Multiplexor module")
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Cc: Tom Herbert <tom@herbertland.com>
    Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    c0338aff
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
kcmproc.c Loading commit data...
kcmsock.c Loading commit data...