mirror of
https://github.com/torvalds/linux.git
synced 2026-10-07 05:31:08 -04:00
Tetsuo Handa
3a58f13a88
syzbot is reporting use-after-free read in tcp_retransmit_timer() [1], for TCP socket used by RDS is accessing sock_net() without acquiring a refcount on net namespace. Since TCP's retransmission can happen after a process which created net namespace terminated, we need to explicitly acquire a refcount. Link: https://syzkaller.appspot.com/bug?extid=694120e1002c117747ed [1] Reported-by: syzbot <[email protected]> Fixes:26abe14379("net: Modify sk_alloc to not reference count the netns of kernel sockets.") Fixes:8a68173691("net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket") Signed-off-by: Tetsuo Handa <[email protected]> Tested-by: syzbot <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Paolo Abeni <[email protected]>