Skip to content

Commit

Permalink
tipc: fix the skb_unshare() in tipc_buf_append()
Browse files Browse the repository at this point in the history
skb_unshare() drops a reference count on the old skb unconditionally,
so in the failure case, we end up freeing the skb twice here.
And because the skb is allocated in fclone and cloned by caller
tipc_msg_reassemble(), the consequence is actually freeing the
original skb too, thus triggered the UAF by syzbot.

Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy().

Fixes: ff48b62 ("tipc: use skb_unshare() instead in tipc_buf_append()")
Reported-and-tested-by: [email protected]
Cc: Jon Maloy <[email protected]>
Cc: Ying Xue <[email protected]>
Signed-off-by: Cong Wang <[email protected]>
Reviewed-by: Xin Long <[email protected]>
Signed-off-by: Jakub Kicinski <[email protected]>
  • Loading branch information
congwang authored and kuba-moo committed Oct 10, 2020
1 parent 923527d commit ed42989
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion net/tipc/msg.c
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
if (fragid == FIRST_FRAGMENT) {
if (unlikely(head))
goto err;
frag = skb_unshare(frag, GFP_ATOMIC);
if (skb_cloned(frag))
frag = skb_copy(frag, GFP_ATOMIC);
if (unlikely(!frag))
goto err;
head = *headbuf = frag;
Expand Down

0 comments on commit ed42989

Please sign in to comment.