From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:60678 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755709AbcIUIGk (ORCPT ); Wed, 21 Sep 2016 04:06:40 -0400 Subject: Patch "tcp: fix use after free in tcp_xmit_retransmit_queue()" has been added to the 4.7-stable tree To: edumazet@google.com, davem@davemloft.net, gregkh@linuxfoundation.org, ilpo.jarvinen@helsinki.fi, marco.gra@gmail.com, ncardwell@google.com, xiyou.wangcong@gmail.com, ycheng@google.com Cc: , From: Date: Wed, 21 Sep 2016 10:05:54 +0200 Message-ID: <1474445154230128@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled tcp: fix use after free in tcp_xmit_retransmit_queue() to the 4.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch and it can be found in the queue-4.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Wed Sep 21 10:05:18 CEST 2016 From: Eric Dumazet Date: Wed, 17 Aug 2016 05:56:26 -0700 Subject: tcp: fix use after free in tcp_xmit_retransmit_queue() From: Eric Dumazet [ Upstream commit bb1fceca22492109be12640d49f5ea5a544c6bb4 ] When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the tail of the write queue using tcp_add_write_queue_tail() Then it attempts to copy user data into this fresh skb. If the copy fails, we undo the work and remove the fresh skb. Unfortunately, this undo lacks the change done to tp->highest_sack and we can leave a dangling pointer (to a freed skb) Later, tcp_xmit_retransmit_queue() can dereference this pointer and access freed memory. For regular kernels where memory is not unmapped, this might cause SACK bugs because tcp_highest_sack_seq() is buggy, returning garbage instead of tp->snd_nxt, but with various debug features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. This bug was found by Marco Grassi thanks to syzkaller. Fixes: 6859d49475d4 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb") Reported-by: Marco Grassi Signed-off-by: Eric Dumazet Cc: Ilpo J�rvinen Cc: Yuchung Cheng Cc: Neal Cardwell Acked-by: Neal Cardwell Reviewed-by: Cong Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/net/tcp.h | 2 ++ 1 file changed, 2 insertions(+) --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1522,6 +1522,8 @@ static inline void tcp_check_send_head(s { if (sk->sk_send_head == skb_unlinked) sk->sk_send_head = NULL; + if (tcp_sk(sk)->highest_sack == skb_unlinked) + tcp_sk(sk)->highest_sack = NULL; } static inline void tcp_init_send_head(struct sock *sk) Patches currently in stable-queue which might be from edumazet@google.com are queue-4.7/bonding-fix-bonding-crash.patch queue-4.7/tcp-properly-scale-window-in-tcp_v_reqsk_send_ack.patch queue-4.7/tcp-fastopen-avoid-negative-sk_forward_alloc.patch queue-4.7/udp-fix-poll-issue-with-zero-sized-packets.patch queue-4.7/tcp-fix-use-after-free-in-tcp_xmit_retransmit_queue.patch queue-4.7/tun-fix-transmit-timestamp-support.patch