Subject: Re: [PATCH net] tipc: clear sock->sk on the failed-insert path in
tipc_sk_create()

Hi Tung,

Thanks for reproducing and testing. Decoded with
scripts/decode_stacktrace.sh (line numbers are current mainline
net/tipc/socket.c / net/core/sock.c /
net/socket.c):

BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
Write of size 8 at addr ffff8880047cdc38 by task init/1 Call Trace:
lock_sock_nested (include/linux/instrumented.h:112 net/core/sock.c:3839)
tipc_release (include/net/sock.h:1713 net/tipc/socket.c:638)   // lock_sock(sk)
__sock_release (net/socket.c:710)
sock_close (net/socket.c:1501)
__fput (fs/file_table.c:512)

Allocated by task 1:
sk_alloc (net/core/sock.c:2308)
tipc_sk_create (net/tipc/socket.c:487)   // sk = sk_alloc(...)
tipc_accept (net/tipc/socket.c:2744)
do_accept (net/socket.c:2034)

Freed by task 1:
__sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
tipc_sk_create (net/tipc/socket.c:504)   // sk_free(sk) on the tipc_sk_insert()
failure path
tipc_accept (net/tipc/socket.c:2744)
do_accept (net/socket.c:2034)

So the same sk is allocated at socket.c:487, freed at socket.c:504 (the
sk_free() right before the line this patch adds), and then written at
socket.c:638 (lock_sock()) from tipc_release() on the accept() fput cleanup.

I meant to say please send V2 with above decoded stack trace in your changelog.

Thanks,
Daehyeon