On Thu, Jul 09, 2020 at 10:00:42PM +0200, Jann Horn wrote:

On Thu, Jul 9, 2020 at 8:26 PM Kees Cook [off-list ref] wrote:

quoted

The sock counting (sock_update_netprioidx() and sock_update_classid())
was missing from pidfd's implementation of received fd installation. Add
a call to the new __receive_sock() helper.

[...]

quoted

diff --git a/kernel/pid.c b/kernel/pid.c

[...]

quoted

@@ -642,10 +643,12 @@ static int pidfd_getfd(struct pid *pid, int fd)
        }

        ret = get_unused_fd_flags(O_CLOEXEC);
-       if (ret < 0)
+       if (ret < 0) {
                fput(file);
-       else
+       } else {
                fd_install(ret, file);
+               __receive_sock(file);
+       }

__receive_sock() has to be before fd_install(), otherwise `file` can
be a dangling pointer.

Burned by fd_install()'s API again. Thanks. I will respin.

-- 
Kees Cook