lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 002/139] tipc: fix the skb_unshare() in tipc_buf_append()
    Date
    From: Cong Wang <xiyou.wangcong@gmail.com>

    [ Upstream commit ed42989eab57d619667d7e87dfbd8fe207db54fe ]

    skb_unshare() drops a reference count on the old skb unconditionally,
    so in the failure case, we end up freeing the skb twice here.
    And because the skb is allocated in fclone and cloned by caller
    tipc_msg_reassemble(), the consequence is actually freeing the
    original skb too, thus triggered the UAF by syzbot.

    Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy().

    Fixes: ff48b6222e65 ("tipc: use skb_unshare() instead in tipc_buf_append()")
    Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com
    Cc: Jon Maloy <jmaloy@redhat.com>
    Cc: Ying Xue <ying.xue@windriver.com>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Reviewed-by: Xin Long <lucien.xin@gmail.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/tipc/msg.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/net/tipc/msg.c
    +++ b/net/tipc/msg.c
    @@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **hea
    if (fragid == FIRST_FRAGMENT) {
    if (unlikely(head))
    goto err;
    - frag = skb_unshare(frag, GFP_ATOMIC);
    + if (skb_cloned(frag))
    + frag = skb_copy(frag, GFP_ATOMIC);
    if (unlikely(!frag))
    goto err;
    head = *headbuf = frag;

    \
     
     \ /
      Last update: 2020-10-27 19:23    [W:4.030 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site