From: Eric Dumazet
Date: Fri, 18 May 2018 04:47:55 -0700
> We must not call sock_diag_has_destroy_listeners(sk) on a socket
> that has no reference on net structure.
...
> Fixes: b922622ec6ef ("sock_diag: don't broadcast kernel sockets")
> Signed-off-by: Eric Dumazet
> Cc: Craig Gallek
> Repor
On Fri, May 18, 2018 at 7:47 AM, Eric Dumazet wrote:
> We must not call sock_diag_has_destroy_listeners(sk) on a socket
> that has no reference on net structure.
>
> BUG: KASAN: use-after-free in sock_diag_has_destroy_listeners
> include/linux/sock_diag.h:75 [inline]
> BUG: KASAN: use-after-free
We must not call sock_diag_has_destroy_listeners(sk) on a socket
that has no reference on net structure.
BUG: KASAN: use-after-free in sock_diag_has_destroy_listeners
include/linux/sock_diag.h:75 [inline]
BUG: KASAN: use-after-free in __sk_free+0x329/0x340 net/core/sock.c:1609
Read of size 8 at a
