From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2CA00386C03 for ; Mon, 13 Jul 2026 07:43:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783928636; cv=none; b=TnYiS5F/1G76Tg7vK9DnVafA6xdZfXIuV8cN+x/piF+eMr2Z72aKzcZ/bae6jLvsWCwlfJmIm5cFKdCy6cGPYTTO3jd2suuliH4jNledfBzJyESRQbG7RFbyQ+dJRNPlwZ6IEydqTqy4GX5CIiRQSMBUJHZp3lsg6ntteg6oWvg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783928636; c=relaxed/simple; bh=AAaNItx7PoGwXieW+iUsmGp2F78HS5z6sxkgExs6Rdw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nSIVjiQfPY4rTXojG1BWk4q/UavAd4rzTFG5Si+m4OU22o8Rg0UgIeSPvG1iwcopXvQ+fTr4UVCpRJRNNCeN1QeHcQiXPdJW38NHNXKs2PNZ72NyaaaHidTnelgwafcU54WFhGx5LmNeDJ4iMge+eOzckYDeFHhmQAHTk+Netvk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bJ9bUS/M; arc=none smtp.client-ip=209.85.215.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bJ9bUS/M" Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-c95d0a54ea5so1945021a12.0 for ; Mon, 13 Jul 2026 00:43:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783928634; x=1784533434; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AmfefPSEnZ5TnAAkRvtRWNfNvlfXKltz+ZQkAhJgUSo=; b=bJ9bUS/MVHOnOXpOYACoPf/ZqVosmWjz9jg6N4jB/C8ZbGQTIHhDgp+CbGsj+rxJYL 3dKsaLLXV458wHTYBNTsBYPBi6//Sqj8eAMJ+23bQcDypPjecmES6Pp+F791im4l+8HE NfCqvuYlUgBNIAg8SoDQb7WXOmXq5J7sQxlGJZ41WVLOEHzS4oEJJdoj4Z1AQ1jejTY8 S4zCLTWvPveFaEMe0Vw8sbNzqzcArzKO1Y7XNppIJTuissas1C4yttBBTz/iE05FVA6B MLfVv/ocEyx8FS5UOKC0h1c/mx6WYXZOpYpseafzVOzMKqDF+z2+v7N+VC2llZYIwlN0 OI/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783928634; x=1784533434; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=AmfefPSEnZ5TnAAkRvtRWNfNvlfXKltz+ZQkAhJgUSo=; b=XXApLYR+pXLFWxzmA6V8dO6Wae/w9v/0Fx4YZmGwibmU/zXfRF5YJ5uILDpicMjI+M erPgQs4OtFjeohu0kLAw7aor7CSLwRoISQp8+/Zb5liGFGBfBqQpfmgrZZd74MhL/2Uk c1OJZ+xEMY/OpchCV37d1kLT1JaRC7n8847JfuV8/LlRMdgAEnHa6QFOFcXn6u8ztUau vTNPiNr1o5o6XUUNZnyAzBWfDS5fpt3YE7Za+JBOULgfFpv+eW/w+uOSQYsol7PHA2Bo 2lVIXRYwiqUM3y97/b7O6ltAFxwCEBC+iMgiVtuH1qMQVzKm4yCU65Us6ZTs0DZz4mNP /K4A== X-Forwarded-Encrypted: i=1; AHgh+Rr1p3DLOniSLgKhFTAvXdfR5EXOnUvaduOoElf6igjPdS9h14zdHRUSu+NecAreaOCjhx/TgEAY7GgjU/g=@vger.kernel.org X-Gm-Message-State: AOJu0YzPQDoIKP9M/KstjZfW1lqujkNKMAwM0i/HlZhnDO1ps5+F4j9f x6AXe8F6xg9JExHBSMIDb5Y5VuRfvEK5yXwMe1meVAI+nTkNCWA6nSL1 X-Gm-Gg: AfdE7cmxrX1MO52W5+5OJP6t+ZnHZUFdzJlWgPyGQSJfTwUQDHQd32l28FVy34uZX6v be+AUB23uitiOVkqqIc2p+Viqje9glueM2PiC/p+B3MBOy7dtuLmWxX5MlPMyRYORSSuIee/Fej 21P+hNOGI4hfhjilXG1XWSjsGSfYRlCOlP2tcS4mrAusa6jXbmfsGiCdKfD1uBVY8mfh12nhe42 QH+rNPbL7lhLe48QVB9X3UGdm/fhL8pEcC04RrSYG8tNbVn9HM9DsirpVVFA+371SITjyPjTxmU D9exkcsyVzN+lo5t78GMuYvQT7bBJDEZ9TC/NjY5/93sVaxNdgDIQnVyI7RQ0vAXSD2mmmL6nG5 zJuhnlW37Bqg/uhnrKlbpotgyvqYMLcqZ6ZElqMpT/obl7NLVdOTOug4cUOLRKciJuh7BvwkL6z /JUm2Q5049mfiUOYptf17o221A X-Received: by 2002:a05:6a20:72a5:b0:398:6ea8:21d2 with SMTP id adf61e73a8af0-3c110a69208mr8562324637.19.1783928634554; Mon, 13 Jul 2026 00:43:54 -0700 (PDT) Received: from ancienth-X870E-Nova-WiFi ([125.186.72.2]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-ca5afeb060bsm8007310a12.14.2026.07.13.00.43.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 00:43:54 -0700 (PDT) From: Daehyeon Ko <4ncienth@gmail.com> To: Tung Quang Nguyen Cc: netdev@vger.kernel.org, Jon Maloy , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , tipc-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org, Daehyeon Ko <4ncienth@gmail.com> Subject: Re: [PATCH net] tipc: clear sock->sk on the failed-insert path in tipc_sk_create() Date: Mon, 13 Jul 2026 16:43:24 +0900 Message-ID: <20260713074324.3577116-1-4ncienth@gmail.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi Tung, Thanks for reproducing and testing. Decoded with scripts/decode_stacktrace.sh (line numbers are current mainline net/tipc/socket.c / net/core/sock.c / net/socket.c): BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839) Write of size 8 at addr ffff8880047cdc38 by task init/1 Call Trace: lock_sock_nested (include/linux/instrumented.h:112 net/core/sock.c:3839) tipc_release (include/net/sock.h:1713 net/tipc/socket.c:638) // lock_sock(sk) __sock_release (net/socket.c:710) sock_close (net/socket.c:1501) __fput (fs/file_table.c:512) Allocated by task 1: sk_alloc (net/core/sock.c:2308) tipc_sk_create (net/tipc/socket.c:487) // sk = sk_alloc(...) tipc_accept (net/tipc/socket.c:2744) do_accept (net/socket.c:2034) Freed by task 1: __sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391) tipc_sk_create (net/tipc/socket.c:504) // sk_free(sk) on the tipc_sk_insert() failure path tipc_accept (net/tipc/socket.c:2744) do_accept (net/socket.c:2034) So the same sk is allocated at socket.c:487, freed at socket.c:504 (the sk_free() right before the line this patch adds), and then written at socket.c:638 (lock_sock()) from tipc_release() on the accept() fput cleanup. Thanks, Daehyeon