In the unreserved path of kcm_unattach(), the reference held by the psock on the underlying TCP socket is dropped with sock_put() before the socket file is released with fput(csk->sk_socket->file) and before release_sock() is called at the end of the function. If that was the last reference on the socket, both uses access freed memory. Drop the socket reference only after the last use of the socket: move the fput() before the sock_put() and release the socket lock before dropping the final reference. Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- net/kcm/kcmsock.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index 3912e75079f5..b3838a19f0a7 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1457,9 +1457,11 @@ static void kcm_unattach(struct kcm_psock *psock) mux->psocks_cnt--; spin_unlock_bh(&mux->lock); - sock_put(csk); fput(csk->sk_socket->file); kmem_cache_free(kcm_psockp, psock); + release_sock(csk); + sock_put(csk); + return; } release_sock(csk); -- 2.34.1