Eric Dumazet 2a111a3c24 UPSTREAM: tcp: fix use after free in tcp_xmit_retransmit_queue() ... (cherry picked from commit bb1fceca22) When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the tail of the write queue using tcp_add_write_queue_tail() Then it attempts to copy user data into this fresh skb. If the copy fails, we undo the work and remove the fresh skb. Unfortunately, this undo lacks the change done to tp->highest_sack and we can leave a dangling pointer (to a freed skb) Later, tcp_xmit_retransmit_queue() can dereference this pointer and access freed memory. For regular kernels where memory is not unmapped, this might cause SACK bugs because tcp_highest_sack_seq() is buggy, returning garbage instead of tp->snd_nxt, but with various debug features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. This bug was found by Marco Grassi thanks to syzkaller. Fixes: 6859d49475 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb") Reported-by: Marco Grassi <marco.gra@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Cc: Yuchung Cheng <ycheng@google.com> Cc: Neal Cardwell <ncardwell@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Change-Id: I58bb02d6e4e399612e8580b9e02d11e661df82f5 Bug: 31183296		2016-09-14 14:26:42 +05:30
..
acpi	Merge branch 'acpi-pci'	2015-11-07 01:30:10 +01:00
asm-generic	Merge tag 'v4.4.17' into linux-linaro-lsk-v4.4	2016-08-11 12:15:51 +08:00
clocksource
crypto	crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path	2016-02-17 12:31:03 -08:00
drm	drm/ttm: Make ttm_bo_mem_compat available	2016-07-27 09:47:35 -07:00
dt-bindings	ARM: DT updates for v4.4	2015-11-10 15:06:26 -08:00
keys
kvm	KVM: arm/arm64: arch_timer: Preserve physical dist. active state on LR.active	2015-11-24 18:07:40 +01:00
linux	RFC: FROMLIST: cgroup: avoid synchronize_sched() in __cgroup_procs_write()	2016-09-14 14:26:20 +05:30
math-emu
media	videobuf2-core: Check user space planes array in dqbuf	2016-05-04 14:48:50 -07:00
memory
misc
net	UPSTREAM: tcp: fix use after free in tcp_xmit_retransmit_queue()	2016-09-14 14:26:42 +05:30
pcmcia
ras
rdma	IB/security: Restrict use of the write() interface	2016-05-04 14:48:48 -07:00
rxrpc
scsi	scsi: Add intermediate STARGET_REMOVE state to scsi_target_state	2016-06-01 12:15:54 -07:00
soc	ARM: SoC driver updates for v4.4	2015-11-10 15:00:03 -08:00
sound	ALSA: rawmidi: Make snd_rawmidi_transmit() race-free	2016-02-17 12:30:58 -08:00
target	target: Fix WRITE_SAME/DISCARD conversion to linux 512b sectors	2016-03-09 15:34:51 -08:00
trace	trace: cpufreq: fix typo in min/max cpufreq	2016-04-07 16:50:03 +05:30
uapi	ANDROID: net: core: fix UID-based routing	2016-08-18 18:56:03 +05:30
video	Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android	2016-06-14 17:08:03 +08:00
xen	xen: Fix page <-> pfn conversion on 32 bit systems	2016-05-11 11:21:14 +02:00
Kbuild