tree aede65c4ad7c6f73be914355a1c6db062e7ea98b
parent f0a17ae8c202d5a336af2d6a5d18abbcda359476
author Ignat Korchagin <ignat@cloudflare.com> 1728920280 +0100
committer Kevin Berry <kpberry@google.com> 1736551407 -0800

af_packet: avoid erroring out after sock_init_data() in packet_create()

[ Upstream commit 46f2a11cb82b657fd15bab1c47821b635e03838b ]

After sock_init_data() the allocated sk object is attached to the provided
sock object. On error, packet_create() frees the sk object leaving the
dangling pointer in the sock object on return. Some other code may try
to use this pointer and cause use-after-free.

BUG=b/388762512
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2024-56606 in the Linux kernel.

cos-patch: security-high
Suggested-by: Eric Dumazet <edumazet@google.com>
Change-Id: If5a3dcdf5ff4febd12a1fd08d52e838938fe4283
Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20241014153808.51894-2-ignat@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kernel CVE Triage Automation <cloud-image-kernel-cve-triage-automation@prod.google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/90043
Reviewed-by: Kevin Berry <kpberry@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Shuo Yang <gshuoy@google.com>