From 5308a2049b764aa55513c90c68933abf596c51d2 Mon Sep 17 00:00:00 2001 From: Tung Nguyen Date: Fri, 23 Oct 2026 12:28:18 +0700 Subject: [PATCH] tipc: fix refcount panic in tipc_rcv() when receiving shared skb TIPC assumes that the received skb is not shared with other users. However, syzbot reports a bug triggered by receiving a shared skb: ... RIP: 0010:pskb_expand_head+0x135a/0x13a0 net/core/skbuff.c:2308 __pskb_pull_tail+0x111/0x1870 net/core/skbuff.c:2890 skb_cow_data+0x2ed/0xc50 net/core/skbuff.c:5398 tipc_aead_decrypt net/tipc/crypto.c:892 [inline] tipc_crypto_rcv+0x346/0x23d0 net/tipc/crypto.c:1843 tipc_rcv+0x4b7/0x1040 net/tipc/node.c:2119 tipc_l2_rcv_msg+0x2d9/0x470 net/tipc/bearer.c:669 deliver_ptype_list_skb net/core/dev.c:2533 [inline] ... The root cause is that local delivery hooks in the kernel (e.g., deliver_skb()) may increment the skb's reference count (`users`) before TIPC processes it on ingress. Fix this by calling skb_share_check() to ensure exclusive ownership before passing the skb to tipc_rcv(). As TIPC needs to modify the skb's data, the cloned skb needs to be uncloned when needed. This can be addressed in separate patch. Reported-by: syzbot+0017742620a9d06f06ef@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0017742620a9d06f06ef Closes: https://lore.kernel.org/all/20261018145928.58317-1-ngocthang2710.1999@gmail.com/T/ Fixes: b97bf3fd8f6a ("[TIPC] Initial merge") Co-developed-by: Nguyen Ngoc Thang Signed-off-by: Nguyen Ngoc Thang Signed-off-by: Tung Nguyen Link: https://patch.msgid.link/20261023052921.54220-1-tung.quang.nguyen@est.tech Signed-off-by: Jakub Kicinski --- net/tipc/bearer.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c index 65fa18928fe3..774f68d1a2b3 100644 --- a/net/tipc/bearer.c +++ b/net/tipc/bearer.c @@ -661,6 +661,10 @@ static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev, { struct tipc_bearer *b; + skb = skb_share_check(skb, GFP_ATOMIC); + if (!skb) + return NET_RX_DROP; + rcu_read_lock(); b = rcu_dereference(dev->tipc_ptr) ?: rcu_dereference(orig_dev->tipc_ptr);