Re: [PATCH net] tcp: fix use-after-free of the listener's ipv6_pinfo after IPV6_ADDRFORM

IPV6_ADDRFORM moves an established AF_INET6 TCP socket over to tcp_prot
and ipv4_specific. The socket is still a tcp6_sock though, so ->pinet6
keeps pointing at the ipv6_pinfo inside it and sk_destruct stays the IPv6
one; commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6
sk->sk_destruct().") relies on that to release the IPv6 state.

Once such a socket is disconnected and listen()ed again, its children are
cloned from an IPv6 parent but allocated from tcp_prot, so they have no
ipv6_pinfo of their own and inherit the listener's ->pinet6 and its IPv6
destructor. The only thing that would fix that up is
tcp_v6_mapped_child_init(), which is not passed to tcp_v4_syn_recv_sock()
on this path. A child accepted from such a listener can outlive it, and
its destructor then runs inet6_cleanup_sock() on the freed listener.

Commit 858d2a4f67ff ("tcp: fix potential race in tcp_v6_syn_recv_sock()")
added opt_child_init for the v4-mapped child; this is the same stale
->pinet6 on the path that never gets it.

Clear the IPv6 fields on the child. The converted listener has to keep
its own, so there is nothing to clear on the IPV6_ADDRFORM side.

Fixes: d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <redacted>
---
 net/ipv4/tcp_ipv4.c | 6 +++++-
 net/ipv6/af_inet6.c | 3 +++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 7f413f509d7dce..f830b212d38e49 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c

@@ -1730,8 +1730,12 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
        sk_setup_caps(newsk, dst);

 #if IS_ENABLED(CONFIG_IPV6)
-       if (opt_child_init)
+       if (opt_child_init) {
                opt_child_init(newsk, sk);
+       } else {
+               newinet->pinet6 = NULL;
+               newinet->ipv6_fl_list = NULL;

+       }
 #endif
        tcp_ca_openreq_child(newsk, dst);

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 282912a1199992..2090289408c035 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c

@@ -479,6 +479,9 @@ void inet6_cleanup_sock(struct sock *sk)
        struct sk_buff *skb;
        struct ipv6_txoptions *opt;

+       if (!np)
+               return;
+
        /* Release rx options */

        skb = xchg(&np->pktoptions, NULL);
--

2.43.0