From 1f8824fe7f6eaaf2355404db08d3cd05a28aa576 Mon Sep 17 00:00:00 2001 From: Xiang Mei Date: Sat, 12 Sep 2026 14:54:01 -0700 Subject: [PATCH] vdpa: fix double free of the reply skb in vdpa_nl_cmd_dev_config_get_doit() genlmsg_reply() consumes the reply skb on every outcome: netlink_unicast() frees it whether it queues it, drops it, or bails out early. vdpa_nl_cmd_dev_config_get_doit() lets its return value fall through to the shared error label, which calls nlmsg_free(msg) again and double-frees the sk_buff on any reply failure. The failure is reachable unprivileged: VDPA_CMD_DEV_CONFIG_GET carries no GENL_ADMIN_PERM, so batching several requests into one sendto() on a socket with a shrunken SO_RCVBUF fills the receive queue, and netlink_attachskb() then takes its MSG_DONTWAIT path, freeing the skb and returning -EAGAIN. Set msg to NULL once genlmsg_reply() has consumed it so the shared exit path frees the skb only on the early error gotos that still own it; nlmsg_free(NULL) is a no-op. BUG: KASAN: slab-use-after-free in sk_skb_reason_drop (net/core/skbuff.c:1220) Read of size 4 at addr ffff88800d99d49c by task exploit/147 Call Trace: sk_skb_reason_drop (net/core/skbuff.c:1220) vdpa_nl_cmd_dev_config_get_doit (drivers/vdpa/vdpa.c:1324) genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114) genl_rcv_msg (net/netlink/genetlink.c:1194) netlink_rcv_skb (net/netlink/af_netlink.c:2556) genl_rcv (net/netlink/genetlink.c:1218) netlink_unicast (net/netlink/af_netlink.c:1345) netlink_sendmsg (net/netlink/af_netlink.c:1900) __sys_sendto (net/socket.c:2281) __x64_sys_sendto (net/socket.c:2284) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) The buggy address belongs to the object at ffff88800d99d3c0 which belongs to the cache skbuff_head_cache of size 232 The buggy address is located 220 bytes inside of freed 232-byte region [ffff88800d99d3c0, ffff88800d99d4a8) Fixes: ad69dd0bf26b ("vdpa: Introduce query of device config layout") Reported-by: co+6dcbccedc9ec6452@bugs.sh Closes: https://lore.kernel.org/all/ILTHcT8oe1HP47sY25JVxssvKmkCTjYlX9Hs%40bugs.sh/ Assisted-by: Claude:claude-opus-5 Signed-off-by: Xiang Mei Signed-off-by: Michael S. Tsirkin Reported-by: Paul Moses Message-ID: <20260912215401.126194-1-xmei5@asu.edu> --- drivers/vdpa/vdpa.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c index 47c6c3d23f5c..6455f837dd26 100644 --- a/drivers/vdpa/vdpa.c +++ b/drivers/vdpa/vdpa.c @@ -1313,15 +1313,16 @@ static int vdpa_nl_cmd_dev_config_get_doit(struct sk_buff *skb, struct genl_info } err = vdpa_dev_config_fill(vdev, msg, info->snd_portid, info->snd_seq, 0, info->extack); - if (!err) + if (!err) { err = genlmsg_reply(msg, info); + msg = NULL; + } mdev_err: put_device(dev); dev_err: up_read(&vdpa_dev_lock); - if (err) - nlmsg_free(msg); + nlmsg_free(msg); return err; }