From patchwork Tue Oct 27 13:48:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 306884 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9837C63699 for ; Tue, 27 Oct 2020 18:21:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 84B63207E8 for ; Tue, 27 Oct 2020 18:21:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603822904; bh=Noym+lf8cZ47Ly+mv+s8DXWgLUwSiQZUDXTZQt2zu7A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VPBIw2rT/WCiBHDRUl1Bnu3c8yahkPwhF45q3O4IRVjLZ8UaG8y/4bHgpbx4QUg4t 372F6kWM8gzPJcjqOxU3fuVr989v1vP01Fxy2XuQPu52fhBW3XXVPPXu8Q+gTVZ430 8RpWMmAIjCiRcLYcVeqM7VuTsTwZtT8QI//pILtI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1827143AbgJ0SVn (ORCPT ); Tue, 27 Oct 2020 14:21:43 -0400 Received: from mail.kernel.org ([198.145.29.99]:50310 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753143AbgJ0OC2 (ORCPT ); Tue, 27 Oct 2020 10:02:28 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4B6982222C; Tue, 27 Oct 2020 14:02:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603807347; bh=Noym+lf8cZ47Ly+mv+s8DXWgLUwSiQZUDXTZQt2zu7A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nsfO695P9Qw77A36GtKcSFJPBnfscrys34jFxZ76vba7yzEERX8r7oH0tjGBcQhCP TwXDyVRrJtaiJocZTG5yVtWbEBmwcW+0tDIbXaSfPfu2bmHuAi7cxPZnKmoNtpqdeP gg3q5q7Ds5FvGUCvrIwivtptb05c1oLs7oIA9jt8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jon Maloy , Ying Xue , Cong Wang , Xin Long , Jakub Kicinski , syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com Subject: [PATCH 4.9 002/139] tipc: fix the skb_unshare() in tipc_buf_append() Date: Tue, 27 Oct 2020 14:48:16 +0100 Message-Id: <20201027134902.258213611@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027134902.130312227@linuxfoundation.org> References: <20201027134902.130312227@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Cong Wang [ Upstream commit ed42989eab57d619667d7e87dfbd8fe207db54fe ] skb_unshare() drops a reference count on the old skb unconditionally, so in the failure case, we end up freeing the skb twice here. And because the skb is allocated in fclone and cloned by caller tipc_msg_reassemble(), the consequence is actually freeing the original skb too, thus triggered the UAF by syzbot. Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy(). Fixes: ff48b6222e65 ("tipc: use skb_unshare() instead in tipc_buf_append()") Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com Cc: Jon Maloy Cc: Ying Xue Signed-off-by: Cong Wang Reviewed-by: Xin Long Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/tipc/msg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **hea if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - frag = skb_unshare(frag, GFP_ATOMIC); + if (skb_cloned(frag)) + frag = skb_copy(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; head = *headbuf = frag;