Commit af9f691f authored by Cong Wang's avatar Cong Wang Committed by David S. Miller

qrtr: orphan socket in qrtr_release()

We have to detach sock from socket in qrtr_release(),
otherwise skb->sk may still reference to this socket
when the skb is released in tun->queue, particularly
sk->sk_wq still points to &sock->wq, which leads to
a UAF.

Fixes: 28fb4e59 ("net: qrtr: Expose tunneling endpoint to user space")
Cc: Bjorn Andersson <>
Cc: Eric Dumazet <>
Signed-off-by: default avatarCong Wang <>
Reviewed-by: default avatarEric Dumazet <>
Signed-off-by: default avatarDavid S. Miller <>
parent 657237f5
......@@ -1180,6 +1180,7 @@ static int qrtr_release(struct socket *sock)
sock_set_flag(sk, SOCK_DEAD);
sock->sk = NULL;
if (!sock_flag(sk, SOCK_ZAPPED))
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment