From ab6caaa6ab10ff7e3c6d536277dacf1e644c3cd2 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 17 Aug 2016 05:56:26 -0700 Subject: tcp: fix use after free in tcp_xmit_retransmit_queue() When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the tail of the write queue using tcp_add_write_queue_tail() Then it attempts to copy user data into this fresh skb. If the copy fails, we undo the work and remove the fresh skb. Unfortunately, this undo lacks the change done to tp->highest_sack and we can leave a dangling pointer (to a freed skb) Later, tcp_xmit_retransmit_queue() can dereference this pointer and access freed memory. For regular kernels where memory is not unmapped, this might cause SACK bugs because tcp_highest_sack_seq() is buggy, returning garbage instead of tp->snd_nxt, but with various debug features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. This bug was found by Marco Grassi thanks to syzkaller. Bug 1823317 Bug 1935735 Change-Id: I9bf709b21e5637f338c34d894617f33d84f93ecc Reported-by: Marco Grassi Signed-off-by: Eric Dumazet Signed-off-by: Gagan Grover Reviewed-on: http://git-master/r/1260003 (cherry picked from commit 0c20962647685008dfc6a15fb8a2169ed2abafe6) Reviewed-on: https://git-master.nvidia.com/r/1690290 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu Tested-by: Amulya Yarlagadda Reviewed-by: Winnie Hsu --- include/net/tcp.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/net/tcp.h b/include/net/tcp.h index 13f12c10f03b..013daf1494ba 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1392,6 +1392,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli { if (sk->sk_send_head == skb_unlinked) sk->sk_send_head = NULL; + if (tcp_sk(sk)->highest_sack == skb_unlinked) + tcp_sk(sk)->highest_sack = NULL; } static inline void tcp_init_send_head(struct sock *sk) -- cgit v1.2.3