| From foo@baz Wed 29 Jul 2020 11:19:56 AM CEST |
| From: Cong Wang <xiyou.wangcong@gmail.com> |
| Date: Fri, 24 Jul 2020 09:45:51 -0700 |
| Subject: qrtr: orphan socket in qrtr_release() |
| |
| From: Cong Wang <xiyou.wangcong@gmail.com> |
| |
| [ Upstream commit af9f691f0f5bdd1ade65a7b84927639882d7c3e5 ] |
| |
| We have to detach sock from socket in qrtr_release(), |
| otherwise skb->sk may still reference to this socket |
| when the skb is released in tun->queue, particularly |
| sk->sk_wq still points to &sock->wq, which leads to |
| a UAF. |
| |
| Reported-and-tested-by: syzbot+6720d64f31c081c2f708@syzkaller.appspotmail.com |
| Fixes: 28fb4e59a47d ("net: qrtr: Expose tunneling endpoint to user space") |
| Cc: Bjorn Andersson <bjorn.andersson@linaro.org> |
| Cc: Eric Dumazet <eric.dumazet@gmail.com> |
| Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> |
| Reviewed-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/qrtr/qrtr.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/net/qrtr/qrtr.c |
| +++ b/net/qrtr/qrtr.c |
| @@ -1004,6 +1004,7 @@ static int qrtr_release(struct socket *s |
| sk->sk_state_change(sk); |
| |
| sock_set_flag(sk, SOCK_DEAD); |
| + sock_orphan(sk); |
| sock->sk = NULL; |
| |
| if (!sock_flag(sk, SOCK_ZAPPED)) |
