From: Eric Dumazet <eduma...@google.com> syzkaller found a way to trigger double frees from ip_mc_drop_socket()
It turns out that leave a copy of parent mc_list at accept() time, which is very bad. Very similar to commit 8b485ce69876 ("tcp: do not inherit fastopen_req from parent") Initial report from Pray3r, completed by Andrey one. Thanks a lot to them ! Signed-off-by: Eric Dumazet <eduma...@google.com> Reported-by: Pray3r <pray3...@gmail.com> Reported-by: Andrey Konovalov <andreyk...@google.com> Tested-by: Andrey Konovalov <andreyk...@google.com> --- Notes: - day-0 bug. - Not sure if it makes sense for TCP socket to be able to join MC group ? net/ipv4/tcp_minisocks.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index 717be4de53248352c758b50557987d898340dd4f..03035e2857fc8b6e4cd8af6e46e81048d4de9105 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -448,6 +448,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, minmax_reset(&newtp->rtt_min, tcp_time_stamp, ~0U); newicsk->icsk_rto = TCP_TIMEOUT_INIT; newicsk->icsk_ack.lrcvtime = tcp_time_stamp; + newicsk->icsk_inet.mc_list = NULL; newtp->packets_out = 0; newtp->retrans_out = 0;