On Thu, Jul 9, 2020 at 8:26 PM Kees Cook <[email protected]> wrote: > The sock counting (sock_update_netprioidx() and sock_update_classid()) > was missing from pidfd's implementation of received fd installation. Add > a call to the new __receive_sock() helper. [...] > diff --git a/kernel/pid.c b/kernel/pid.c [...] > @@ -642,10 +643,12 @@ static int pidfd_getfd(struct pid *pid, int fd) > } > > ret = get_unused_fd_flags(O_CLOEXEC); > - if (ret < 0) > + if (ret < 0) { > fput(file); > - else > + } else { > fd_install(ret, file); > + __receive_sock(file); > + }
__receive_sock() has to be before fd_install(), otherwise `file` can be a dangling pointer.
