Cong Wang 26217e062f tipc: fix the skb_unshare() in tipc_buf_append() ... [ Upstream commit ed42989eab ] skb_unshare() drops a reference count on the old skb unconditionally, so in the failure case, we end up freeing the skb twice here. And because the skb is allocated in fclone and cloned by caller tipc_msg_reassemble(), the consequence is actually freeing the original skb too, thus triggered the UAF by syzbot. Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy(). Fixes: ff48b6222e ("tipc: use skb_unshare() instead in tipc_buf_append()") Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com Cc: Jon Maloy <jmaloy@redhat.com> Cc: Ying Xue <ying.xue@windriver.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-10-29 09:54:56 +01:00
..
addr.c	tipc: initialise addr_trail_end when setting node addresses	2019-08-25 10:48:05 +02:00
addr.h	tipc: add 128-bit node identifier	2018-03-23 13:12:18 -04:00
bcast.c	tipc: clean up skb list lock handling on send path	2020-07-29 10:16:47 +02:00
bcast.h	tipc: make replicast a user selectable option	2017-01-20 12:10:17 -05:00
bearer.c	tipc: fix a double free in tipc_enable_bearer()	2019-01-09 17:38:34 +01:00
bearer.h	tipc: implement configuration of UDP media MTU	2018-04-20 11:04:05 -04:00
core.c	tipc: fix ordering of tipc module init and exit routine	2019-12-21 10:57:16 +01:00
core.h	tipc: replace name table service range array with rb tree	2018-03-31 22:19:52 -04:00
diag.c	tipc: switch to rhashtable iterator	2018-08-29 18:04:54 -07:00
discover.c	tipc: fix lockdep warning when reinitilaizing sockets	2018-11-23 08:17:03 +01:00
discover.h	tipc: some cleanups in the file discover.c	2018-03-23 13:12:17 -04:00
eth_media.c
group.c	tipc: Fix memory leak in tipc_group_create_member()	2020-09-26 18:01:30 +02:00
group.h	tipc: extend sock diag for group communication	2018-06-30 21:05:42 +09:00
ib_media.c
Kconfig	tipc: implement socket diagnostics for AF_TIPC	2018-03-22 14:43:35 -04:00
link.c	tipc: clean up skb list lock handling on send path	2020-07-29 10:16:47 +02:00
link.h	tipc: fix failover problem	2018-09-29 11:45:14 -07:00
Makefile	tipc: implement socket diagnostics for AF_TIPC	2018-03-22 14:43:35 -04:00
monitor.c	tipc: update mon's self addr when node addr generated	2020-01-27 14:49:52 +01:00
monitor.h	tipc: update mon's self addr when node addr generated	2020-01-27 14:49:52 +01:00
msg.c	tipc: fix the skb_unshare() in tipc_buf_append()	2020-10-29 09:54:56 +01:00
msg.h	tipc: handle collisions of 32-bit node address hash values	2018-03-23 13:12:18 -04:00
name_distr.c	tipc: eliminate message disordering during binding table update	2020-01-27 14:50:00 +01:00
name_distr.h	tipc: permit overlapping service ranges in name table	2018-03-31 22:19:52 -04:00
name_table.c	tipc: eliminate message disordering during binding table update	2020-01-27 14:50:00 +01:00
name_table.h	tipc: eliminate message disordering during binding table update	2020-01-27 14:50:00 +01:00
net.c	tipc: update mon's self addr when node addr generated	2020-01-27 14:49:52 +01:00
net.h	tipc: fix lockdep warning when reinitilaizing sockets	2018-11-23 08:17:03 +01:00
netlink_compat.c	tipc: fix uninit skb->data in tipc_nl_compat_dumpit()	2020-09-03 11:24:17 +02:00
netlink.c	tipc: add missing attribute validation for MTU property	2020-03-18 07:14:18 +01:00
netlink.h	tipc: make cluster size threshold for monitoring configurable	2016-07-26 14:26:42 -07:00
node.c	tipc: clean up skb list lock handling on send path	2020-07-29 10:16:47 +02:00
node.h	tipc: add sequence number check for link STATE messages	2018-07-11 23:06:14 -07:00
socket.c	tipc: fix shutdown() of connection oriented socket	2020-09-26 18:01:30 +02:00
socket.h	tipc: call start and done ops directly in __tipc_nl_compat_dumpit()	2018-09-06 21:49:18 -07:00
subscr.c	tipc: fix unbalanced reference counter	2018-04-12 21:46:10 -04:00
subscr.h	tipc: fix modprobe tipc failed after switch order of device registration	2019-06-04 08:02:34 +02:00
sysctl.c	tipc: set sysctl_tipc_rmem and named_timeout right range	2020-01-27 14:50:39 +01:00
topsrv.c	tipc: fix memory leak in service subscripting	2020-10-01 13:14:44 +02:00
topsrv.h	tipc: rename tipc_server to tipc_topsrv	2018-02-16 15:26:34 -05:00
udp_media.c	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2020-04-29 16:31:17 +02:00
udp_media.h	tipc: implement configuration of UDP media MTU	2018-04-20 11:04:05 -04:00