conn_put() decreases the reference count of a connection, and when it reaches zero, tipc_conn_kref_release() removes the connection from conn_idr and frees it. Removing the entry is protected by idr_lock, but decreasing the count is not. During netns dismantle, it may happen that a connection gets its count dropped to zero by conn_put() while tipc_topsrv_stop() still holds the lock idr_lock. tipc_topsrv_stop() calls conn_get() on that connection whose count is already zero, and then releases idr_lock. tipc_conn_kref_release() can then free the connection before tipc_conn_close() uses it. KASAN reports a UAF as: BUG: KASAN: slab-use-after-free in tipc_conn_close (net/tipc/topsrv.c:158) Read of size 8 at addr ff1100000cf4f408 by task kworker/u16:3/70 Stop accepting connections before walking conn_idr. Use kref_get_unless_zero() to avoid taking references when the count is zero. Walk forward through conn_idr to disconnect all connections before draining the workqueues. Fixes: 667eeab4999e ("tipc: Fix use-after-free in tipc_conn_close().") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Jérémy Jean --- net/tipc/topsrv.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c index 01dd34b..f3f32fd 100644 --- a/net/tipc/topsrv.c +++ b/net/tipc/topsrv.c @@ -698,19 +698,25 @@ static void tipc_topsrv_stop(struct net *net) struct tipc_topsrv *srv = tipc_topsrv(net); struct socket *lsock = srv->listener; struct tipc_conn *con; - int id; + unsigned long id; + + write_lock_bh(&lsock->sk->sk_callback_lock); + lsock->sk->sk_user_data = NULL; + write_unlock_bh(&lsock->sk->sk_callback_lock); + cancel_work_sync(&srv->awork); spin_lock_bh(&srv->idr_lock); - for (id = 0; srv->idr_in_use; id++) { - con = idr_find(&srv->conn_idr, id); + for (id = 0; (con = idr_get_next_ul(&srv->conn_idr, &id)); id++) { + if (!kref_get_unless_zero(&con->kref)) + con = NULL; + spin_unlock_bh(&srv->idr_lock); if (con) { - conn_get(con); - spin_unlock_bh(&srv->idr_lock); if (con->sock) tipc_conn_close(con); conn_put(con); - spin_lock_bh(&srv->idr_lock); } + cond_resched(); + spin_lock_bh(&srv->idr_lock); } __module_get(lsock->ops->owner); __module_get(lsock->sk->sk_prot_creator->owner); -- 2.47.3