summaryrefslogtreecommitdiff
path: root/net/tipc
diff options
context:
space:
mode:
authorCong Wang <xiyou.wangcong@gmail.com>2020-10-07 21:12:50 -0700
committerJakub Kicinski <kuba@kernel.org>2020-10-09 18:22:56 -0700
commited42989eab57d619667d7e87dfbd8fe207db54fe (patch)
treefdae4819eae47284a2137e45636912a02fa28874 /net/tipc
parent923527dcb4d164925a2fed0b53c6a1625a60a472 (diff)
tipc: fix the skb_unshare() in tipc_buf_append()
skb_unshare() drops a reference count on the old skb unconditionally, so in the failure case, we end up freeing the skb twice here. And because the skb is allocated in fclone and cloned by caller tipc_msg_reassemble(), the consequence is actually freeing the original skb too, thus triggered the UAF by syzbot. Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy(). Fixes: ff48b6222e65 ("tipc: use skb_unshare() instead in tipc_buf_append()") Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com Cc: Jon Maloy <jmaloy@redhat.com> Cc: Ying Xue <ying.xue@windriver.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/tipc')
-rw-r--r--net/tipc/msg.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 52e93ba4d8e2..681224401871 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -150,7 +150,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
if (fragid == FIRST_FRAGMENT) {
if (unlikely(head))
goto err;
- frag = skb_unshare(frag, GFP_ATOMIC);
+ if (skb_cloned(frag))
+ frag = skb_copy(frag, GFP_ATOMIC);
if (unlikely(!frag))
goto err;
head = *headbuf = frag;