• Thadeu Lima de Souza Cascardo's avatar
    net: avoid double iput when sock_alloc_file fails · 649c15c7
    Thadeu Lima de Souza Cascardo authored
    When sock_alloc_file fails to allocate a file, it will call sock_release.
    __sys_socket_file should then not call sock_release again, otherwise there
    will be a double free.
    
    [   89.319884] ------------[ cut here ]------------
    [   89.320286] kernel BUG at fs/inode.c:1764!
    [   89.320656] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
    [   89.321051] CPU: 7 PID: 125 Comm: iou-sqp-124 Not tainted 6.2.0+ #361
    [   89.321535] RIP: 0010:iput+0x1ff/0x240
    [   89.321808] Code: d1 83 e1 03 48 83 f9 02 75 09 48 81 fa 00 10 00 00 77 05 83 e2 01 75 1f 4c 89 ef e8 fb d2 ba 00 e9 80 fe ff ff c3 cc cc cc cc <0f> 0b 0f 0b e9 d0 fe ff ff 0f 0b eb 8d 49 8d b4 24 08 01 00 00 48
    [   89.322760] RSP: 0018:ffffbdd60068bd50 EFLAGS: 00010202
    [   89.323036] RAX: 0000000000000000 RBX: ffff9d7ad3cacac0 RCX: 0000000000001107
    [   89.323412] RDX: 000000000003af00 RSI: 0000000000000000 RDI: ffff9d7ad3cacb40
    [   89.323785] RBP: ffffbdd60068bd68 R08: ffffffffffffffff R09: ffffffffab606438
    [   89.324157] R10: ffffffffacb3dfa0 R11: 6465686361657256 R12: ffff9d7ad3cacb40
    [   89.324529] R13: 0000000080000001 R14: 0000000080000001 R15: 0000000000000002
    [   89.324904] FS:  00007f7b28516740(0000) GS:ffff9d7aeb1c0000(0000) knlGS:0000000000000000
    [   89.325328] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [   89.325629] CR2: 00007f0af52e96c0 CR3: 0000000002a02006 CR4: 0000000000770ee0
    [   89.326004] PKRU: 55555554
    [   89.326161] Call Trace:
    [   89.326298]  <TASK>
    [   89.326419]  __sock_release+0xb5/0xc0
    [   89.326632]  __sys_socket_file+0xb2/0xd0
    [   89.326844]  io_socket+0x88/0x100
    [   89.327039]  ? io_issue_sqe+0x6a/0x430
    [   89.327258]  io_issue_sqe+0x67/0x430
    [   89.327450]  io_submit_sqes+0x1fe/0x670
    [   89.327661]  io_sq_thread+0x2e6/0x530
    [   89.327859]  ? __pfx_autoremove_wake_function+0x10/0x10
    [   89.328145]  ? __pfx_io_sq_thread+0x10/0x10
    [   89.328367]  ret_from_fork+0x29/0x50
    [   89.328576] RIP: 0033:0x0
    [   89.328732] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
    [   89.329073] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9
    [   89.329477] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f7b28637a3d
    [   89.329845] RDX: 00007fff4e4318a8 RSI: 00007fff4e4318b0 RDI: 0000000000000400
    [   89.330216] RBP: 00007fff4e431830 R08: 00007fff4e431711 R09: 00007fff4e4318b0
    [   89.330584] R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff4e441b38
    [   89.330950] R13: 0000563835e3e725 R14: 0000563835e40d10 R15: 00007f7b28784040
    [   89.331318]  </TASK>
    [   89.331441] Modules linked in:
    [   89.331617] ---[ end trace 0000000000000000 ]---
    
    Fixes: da214a47 ("net: add __sys_socket_file()")
    Signed-off-by: default avatarThadeu Lima de Souza Cascardo <cascardo@canonical.com>
    Reviewed-by: default avatarJens Axboe <axboe@kernel.dk>
    Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
    Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
    Link: https://lore.kernel.org/r/20230307173707.468744-1-cascardo@canonical.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    649c15c7
socket.c 89.1 KB