mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
![]() In tipc_buf_append() it may change skb's frag_list, and it causes
problems when this skb is cloned. skb_unclone() doesn't really
make this skb's flag_list available to change.
Shuang Li has reported an use-after-free issue because of this
when creating quite a few macvlan dev over the same dev, where
the broadcast packets will be cloned and go up to the stack:
[ ] BUG: KASAN: use-after-free in pskb_expand_head+0x86d/0xea0
[ ] Call Trace:
[ ] dump_stack+0x7c/0xb0
[ ] print_address_description.constprop.7+0x1a/0x220
[ ] kasan_report.cold.10+0x37/0x7c
[ ] check_memory_region+0x183/0x1e0
[ ] pskb_expand_head+0x86d/0xea0
[ ] process_backlog+0x1df/0x660
[ ] net_rx_action+0x3b4/0xc90
[ ]
[ ] Allocated by task 1786:
[ ] kmem_cache_alloc+0xbf/0x220
[ ] skb_clone+0x10a/0x300
[ ] macvlan_broadcast+0x2f6/0x590 [macvlan]
[ ] macvlan_process_broadcast+0x37c/0x516 [macvlan]
[ ] process_one_work+0x66a/0x1060
[ ] worker_thread+0x87/0xb10
[ ]
[ ] Freed by task 3253:
[ ] kmem_cache_free+0x82/0x2a0
[ ] skb_release_data+0x2c3/0x6e0
[ ] kfree_skb+0x78/0x1d0
[ ] tipc_recvmsg+0x3be/0xa40 [tipc]
So fix it by using skb_unshare() instead, which would create a new
skb for the cloned frag and it'll be safe to change its frag_list.
The similar things were also done in sctp_make_reassembled_event(),
which is using skb_copy().
Reported-by: Shuang Li <shuali@redhat.com>
Fixes:
|
||
---|---|---|
.. | ||
addr.c | ||
addr.h | ||
bcast.c | ||
bcast.h | ||
bearer.c | ||
bearer.h | ||
core.c | ||
core.h | ||
crypto.c | ||
crypto.h | ||
diag.c | ||
discover.c | ||
discover.h | ||
eth_media.c | ||
group.c | ||
group.h | ||
ib_media.c | ||
Kconfig | ||
link.c | ||
link.h | ||
Makefile | ||
monitor.c | ||
monitor.h | ||
msg.c | ||
msg.h | ||
name_distr.c | ||
name_distr.h | ||
name_table.c | ||
name_table.h | ||
net.c | ||
net.h | ||
netlink.c | ||
netlink.h | ||
netlink_compat.c | ||
node.c | ||
node.h | ||
socket.c | ||
socket.h | ||
subscr.c | ||
subscr.h | ||
sysctl.c | ||
topsrv.c | ||
topsrv.h | ||
trace.c | ||
trace.h | ||
udp_media.c | ||
udp_media.h |