Received-SPF: pass (google.com: domain of linux-kernel+bounces-5274-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: mengkanglai <mengkanglai2@huawei.com>
To: "David S. Miller" <davem@davemloft.net>, David Ahern <dsahern@kernel.org>,
	Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, "Paolo
 Abeni" <pabeni@redhat.com>, "netdev@vger.kernel.org"
	<netdev@vger.kernel.org>, "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>
CC: "Fengtao (fengtao, Euler)" <fengtao40@huawei.com>, "Yanan (Euler)"
	<yanan@huawei.com>
Subject: [Consult]kernel tcp socket lack of refcnt for net may cause uaf
 problem?
Thread-Topic: [Consult]kernel tcp socket lack of refcnt for net may cause uaf
 problem?
Thread-Index: AdoygXTr5FKzOdnSR4i43aSi6m/SRw==
Date: Tue, 19 Dec 2023 13:44:36 +0000
Message-ID: <26f7811f5ee247c389ddd38034d8747d@huawei.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
MIME-Version: 1.0

Hello, Eric:

I found upstream have fixed a UAF issue (smc: Fix use-after-free in tcp_wri=
te_timer_handler()):=20
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?=
id=3D9744d2bf19762703704ecba885b7ac282c02eacf

When create a kernel socket use sock_create_kern , it won't call get_net() =
to increase refcnt for net where the socket is located.
I found some other subsystem(like rds and sunrpc) also use sock_create_kern=
 to create kernel tcp socket, I want to know if they have same UAF problem?

Best wishes!