[PATCH v2 2/8] af_packet: avoid erroring out after sock_init_data() in packet_create()

[Ignat Korchagin]

After sock_init_data() the allocated sk object is attached to the provided
sock object. On error, packet_create() frees the sk object leaving the
dangling pointer in the sock object on return. Some other code may try
to use this pointer and cause use-after-free.

Suggested-by: Eric Dumazet <eduma...@google.com>
Signed-off-by: Ignat Korchagin <ig...@cloudflare.com>
---
 net/packet/af_packet.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index a705ec214254..97774bd4b6cb 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3421,17 +3421,17 @@ static int packet_create(struct net *net, struct socket 
*sock, int protocol,
        if (sock->type == SOCK_PACKET)
                sock->ops = &packet_ops_spkt;
 
+       po = pkt_sk(sk);
+       err = packet_alloc_pending(po);
+       if (err)
+               goto out_sk_free;
+
        sock_init_data(sock, sk);
 
-       po = pkt_sk(sk);
        init_completion(&po->skb_completion);
        sk->sk_family = PF_PACKET;
        po->num = proto;
 
-       err = packet_alloc_pending(po);
-       if (err)
-               goto out2;
-
        packet_cached_dev_reset(po);
 
        sk->sk_destruct = packet_sock_destruct;
@@ -3463,7 +3463,7 @@ static int packet_create(struct net *net, struct socket 
*sock, int protocol,
        sock_prot_inuse_add(net, &packet_proto, 1);
 
        return 0;
-out2:
+out_sk_free:
        sk_free(sk);
 out:
        return err;
-- 
2.39.5