Skip to content
  • Mao Wenan's avatar
    net: crypto set sk to NULL when af_alg_release. · 9060cb71
    Mao Wenan authored
    KASAN has found use-after-free in sockfs_setattr.
    The existed commit 6d8c50dc ("socket: close race condition between sock_close()
    and sockfs_setattr()") is to fix this simillar issue, but it seems to ignore
    that crypto module forgets to set the sk to NULL after af_alg_release.
    
    KASAN report details as below:
    BUG: KASAN: use-after-free in sockfs_setattr+0x120/0x150
    Write of size 4 at addr ffff88837b956128 by task syz-executor0/4186
    
    CPU: 2 PID: 4186 Comm: syz-executor0 Not tainted xxx + #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
    1.10.2-1ubuntu1 04/01/2014
    Call Trace:
     dump_stack+0xca/0x13e
     print_address_description+0x79/0x330
     ? vprintk_func+0x5e/0xf0
     kasan_report+0x18a/0x2e0
     ? sockfs_setattr+0x120/0x150
     sockfs_setattr+0x120/0x150
     ? sock_register+0x2d0/0x2d0
     notify_change+0x90c/0xd40
     ? chown_common+0x2ef/0x510
     chown_common+0x2ef/0x510
     ? chmod_common+0x3b0/0x3b0
     ? __lock_is_held+0xbc/0x160
     ? __sb_start_write+0x13d/0x2b0
     ? __...
    9060cb71