When a network namespace is deleted, we free its uevent socket. But sometimes a device in that namespace is still being removed and tries to send a uevent through that socket. The socket is already freed, so KASAN reports a use-after-free. This patch attempts the fix of taking a lock around both the send path and the free path, and clear the pointer before freeing so nobody uses it after free. Reported-by: syzbot Link: https://syzkaller.appspot.com/bug?extid=4393dfdddf166f2de2b0 Signed-off-by: Adarsh Das --- lib/kobject_uevent.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index ddbc4d7482d2..ecba33abb6b1 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -411,9 +411,15 @@ static int kobject_uevent_net_broadcast(struct kobject *kobj, devpath); else { const struct net *net = container_of(ns, struct net, ns); + struct uevent_sock *ue_sk; - ret = uevent_net_broadcast_tagged(net->uevent_sock->sk, env, - action_string, devpath); + mutex_lock(&uevent_sock_mutex); + ue_sk = net->uevent_sock; + if (ue_sk && ue_sk->sk) + ret = uevent_net_broadcast_tagged(ue_sk->sk, env, + action_string, + devpath); + mutex_unlock(&uevent_sock_mutex); } #endif @@ -804,13 +810,17 @@ static int uevent_net_init(struct net *net) static void uevent_net_exit(struct net *net) { - struct uevent_sock *ue_sk = net->uevent_sock; + struct uevent_sock *ue_sk; - if (sock_net(ue_sk->sk)->user_ns == &init_user_ns) { - mutex_lock(&uevent_sock_mutex); + mutex_lock(&uevent_sock_mutex); + ue_sk = net->uevent_sock; + net->uevent_sock = NULL; + if (ue_sk && sock_net(ue_sk->sk)->user_ns == &init_user_ns) list_del(&ue_sk->list); - mutex_unlock(&uevent_sock_mutex); - } + mutex_unlock(&uevent_sock_mutex); + + if (!ue_sk) + return; netlink_kernel_release(ue_sk->sk); kfree(ue_sk); -- 2.55.0