CVE-2024-26741: In the Linux kernel, the following vulnerability has been resolved:dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().syzkaller reported a warning [0] in inet_csk_destroy_sock() with norepro.  WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);However, the syzkaller's log hinted that connect() failed just beforethe warning due to FAULT_INJECTION.  [1]When connect() is called for an unbound socket, we search for anavailable ephemeral port.  If a bhash bucket exists for the port, wecall __inet_check_established() or __inet6_check_established() to checkif the bucket is reusable.If reusable, we add the socket into ehash and set inet_sk(sk)->inet_num.Later, we look up the corresponding bhash2 bucket and try to allocateit if it does not exist.Although it rarely occurs in real use, if the allocation fails, we mustrevert the changes by check_established().  Otherwise, an unconnectedsocket could illegally occupy an ehash entry.Note that we do not put tw back into ehash because sk might havealready responded to a packet for tw and it would be better to freetw earlier under such memory presure.[0]:WARNING: CPU: 0 PID: 350830 at net/ipv4/inet_connection_sock.c:1193 inet_csk_destroy_sock (net/ipv4/inet_connection_sock.c:1193)Modules linked in:Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014RIP: 0010:inet_csk_destroy_sock (net/ipv4/inet_connection_sock.c:1193)Code: 41 5c 41 5d 41 5e e9 2d 4a 3d fd e8 28 4a 3d fd 48 89 ef e8 f0 cd 7d ff 5b 5d 41 5c 41 5d 41 5e e9 13 4a 3d fd e8 0e 4a 3d fd <0f> 0b e9 61 fe ff ff e8 02 4a 3d fd 4c 89 e7 be 03 00 00 00 e8 05RSP: 0018:ffffc9000b21fd38 EFLAGS: 00010293RAX: 0000000000000000 RBX: 0000000000009e78 RCX: ffffffff840bae40RDX: ffff88806e46c600 RSI: ffffffff840bb012 RDI: ffff88811755cca8RBP: ffff88811755c880 R08: 0000000000000003 R09: 0000000000000000R10: 0000000000009e78 R11: 0000000000000000 R12: ffff88811755c8e0R13: ffff88811755c892 R14: ffff88811755c918 R15: 0000000000000000FS:  00007f03e5243800(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000001b32f21000 CR3: 0000000112ffe001 CR4: 0000000000770ef0PKRU: 55555554Call Trace: <TASK> ? inet_csk_destroy_sock (net/ipv4/inet_connection_sock.c:1193) dccp_close (net/dccp/proto.c:1078) inet_release (net/ipv4/af_inet.c:434) __sock_release (net/socket.c:660) sock_close (net/socket.c:1423) __fput (fs/file_table.c:377) __fput_sync (fs/file_table.c:462) __x64_sys_close (fs/open.c:1557 fs/open.c:1539 fs/open.c:1539) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129)RIP: 0033:0x7f03e53852bbCode: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 43 c9 f5 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 c9 f5 ff 8b 44RSP: 002b:00000000005dfba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f03e53852bbRDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000003RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000167cR10: 0000000008a79680 R11: 0000000000000293 R12: 00007f03e4e43000R13: 00007f03e4e43170 R14: 00007f03e4e43178 R15: 00007f03e4e43170 </TASK>[1]:FAULT_INJECTION: forcing a failure.name failslab, interval 1, probability 0, space 0, times 0CPU: 0 PID: 350833 Comm: syz-executor.1 Not tainted 6.7.0-12272-g2121c43f88f5 #9Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1)) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3748) kmem_cache_alloc (mm/slub.c:3763 mm/slub.c:3842 mm/slub.c:3867) inet_bind2_bucket_create ---truncated---