Cong Wang cdc27eb1f5 tipc: fix the skb_unshare() in tipc_buf_append() ... [ Upstream commit ed42989eab ] skb_unshare() drops a reference count on the old skb unconditionally, so in the failure case, we end up freeing the skb twice here. And because the skb is allocated in fclone and cloned by caller tipc_msg_reassemble(), the consequence is actually freeing the original skb too, thus triggered the UAF by syzbot. Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy(). Fixes: ff48b6222e ("tipc: use skb_unshare() instead in tipc_buf_append()") Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com Cc: Jon Maloy <jmaloy@redhat.com> Cc: Ying Xue <ying.xue@windriver.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-10-29 09:06:58 +01:00
..
addr.c
addr.h
bcast.c
bcast.h
bearer.c
bearer.h
core.c
core.h
discover.c
discover.h
eth_media.c
ib_media.c
Kconfig
link.c
link.h
Makefile
monitor.c
monitor.h
msg.c	tipc: fix the skb_unshare() in tipc_buf_append()	2020-10-29 09:06:58 +01:00
msg.h
name_distr.c
name_distr.h
name_table.c
name_table.h
net.c
net.h
netlink.c
netlink.h
netlink_compat.c
node.c
node.h
server.c
server.h
socket.c	tipc: fix shutdown() of connection oriented socket	2020-10-01 13:12:24 +02:00
socket.h
subscr.c
subscr.h
sysctl.c
udp_media.c
udp_media.h