Commit 48156296 authored by Ignat Korchagin's avatar Ignat Korchagin Committed by Jakub Kicinski
Browse files

net: warn, if pf->create does not clear sock->sk on error 



All pf->create implementations have been fixed now to clear sock->sk on
error, when they deallocate the allocated sk object.

Put a warning in place to make sure we don't break this promise in the
future.

Suggested-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarIgnat Korchagin <ignat@cloudflare.com>
Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241014153808.51894-9-ignat@cloudflare.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 9df99c39

net/socket.c

+2 −2
Original line number Diff line number Diff line
@@ -1576,9 +1576,9 @@ int __sock_create(struct net *net, int family, int type, int protocol, 
	err = pf->create(net, sock, protocol, kern);

	if (err < 0) {

		/* ->create should release the allocated sock->sk object on error

		 * but it may leave the dangling pointer

		 * and make sure sock->sk is set to NULL to avoid use-after-free

		 */

		sock->sk = NULL;

		DEBUG_NET_WARN_ON_ONCE(sock->sk);

		goto out_module_put;

	}