Re: CVE-2024-56642: tipc: Fix use-after-free of kernel socket in cleanup_bearer().

[Siddh Raman Pant <siddh.raman.pant@oracle.com>]

[-- Attachment #1: Type: text/plain, Size: 1213 bytes --]

The commit message has:
> tipc: Fix use-after-free of kernel socket in cleanup_bearer().
>
> syzkaller reported a use-after-free of UDP kernel socket
> in cleanup_bearer() without repro. [0][1]
>
> When bearer_disable() calls tipc_udp_disable(), cleanup
> of the UDP kernel socket is deferred by work calling
> cleanup_bearer().
>
> tipc_net_stop() waits for such works to finish by checking
> tipc_net(net)->wq_count.  However, the work decrements the
> count too early before releasing the kernel socket,
> unblocking cleanup_net() and resulting in use-after-free.

This is incorrect, the function which waits is tipc_exit_net, which has
the spinning while loop.

That function is an exit function so this can't be triggered without
privileges.

Could it be grounds for rejection? Probably not but I thought I should
ask.

> Fixes: 26abe14379f8 ("net: Modify sk_alloc to not reference count the netns of kernel sockets.")

The fixes tag is incorrect. It should be the commit which adds the
counter, which is:

04c26faa51d1 ("tipc: wait and exit until all work queues are done")

Maybe this needs to be corrected in the JSONs (as the commits are set
in stone).

Thanks,
Siddh

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]