From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E658C388F9 for ; Tue, 27 Oct 2020 15:21:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0261E20728 for ; Tue, 27 Oct 2020 15:21:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603812064; bh=Wk6oyEMtaxZAZBQtmH1ud7Z24NCHUghIcxVPyF8m00Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NcDHaN01QhcHwEtmfbamz2eQgNZoynOuixzVgIz+sYJq4sF4Yxt6LqQ1caUpxRpMm hXhKwgZUBT9gd9VhSwSfi0trrr6ryAGvVqsHSHl9POLjd1J88NKzjqWO26GWU6KdjN BHEmHfMlDIWnbNpxOX24soYN0EHQEzd/GrnfNCRw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1797004AbgJ0PVC (ORCPT ); Tue, 27 Oct 2020 11:21:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:55726 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1796411AbgJ0PSU (ORCPT ); Tue, 27 Oct 2020 11:18:20 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5D10022264; Tue, 27 Oct 2020 15:18:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603811889; bh=Wk6oyEMtaxZAZBQtmH1ud7Z24NCHUghIcxVPyF8m00Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R/iaM31R8Tt7tiy+KQQZz01LnTy0R5KL5h/919vsR71G8Clb5UOpqFoiPzf3uVQJM kjPzyfHQgIzivaGS/r95ELg9uECIz7FcchQGdz5UNqMPrQy53U7lZe092YEC8fZPXZ Zlevql06OSE2mFW5FNH7SUJ2po3WvWZRZuh4MZxc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jon Maloy , Ying Xue , Cong Wang , Xin Long , Jakub Kicinski , syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com Subject: [PATCH 5.9 019/757] tipc: fix the skb_unshare() in tipc_buf_append() Date: Tue, 27 Oct 2020 14:44:29 +0100 Message-Id: <20201027135451.412736737@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027135450.497324313@linuxfoundation.org> References: <20201027135450.497324313@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Cong Wang [ Upstream commit ed42989eab57d619667d7e87dfbd8fe207db54fe ] skb_unshare() drops a reference count on the old skb unconditionally, so in the failure case, we end up freeing the skb twice here. And because the skb is allocated in fclone and cloned by caller tipc_msg_reassemble(), the consequence is actually freeing the original skb too, thus triggered the UAF by syzbot. Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy(). Fixes: ff48b6222e65 ("tipc: use skb_unshare() instead in tipc_buf_append()") Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com Cc: Jon Maloy Cc: Ying Xue Signed-off-by: Cong Wang Reviewed-by: Xin Long Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/tipc/msg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -150,7 +150,8 @@ int tipc_buf_append(struct sk_buff **hea if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - frag = skb_unshare(frag, GFP_ATOMIC); + if (skb_cloned(frag)) + frag = skb_copy(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; head = *headbuf = frag;