kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/tipc
History
Lee Jones 4ee4deadaa tipc: fix double-free in tipc_buf_append() 
[ Upstream commit d293ca716e ]

tipc_msg_validate() can potentially reallocate the skb it is validating,
freeing the old one.  In tipc_buf_append(), it was being called with a
pointer to a local variable which was a copy of the caller's skb
pointer.

If the skb was reallocated and validation subsequently failed, the error
handling path would free the original skb pointer, which had already
been freed, leading to double-free.

Fix this by checking if head now points to a newly allocated reassembled
skb.  If it does, reassign *headbuf for later freeing operations.

Fixes: d618d09a68 ("tipc: enforce valid ratio between skb truesize and contents")
Suggested-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Signed-off-by: Lee Jones <lee@kernel.org>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-06-01 17:35:40 +02:00
..
addr.c tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
addr.h tipc: introduce new unified address type for internal use 2021-03-17 11:51:04 -07:00
bcast.c net: tipc: avoid possible garbage value 2024-10-17 15:10:47 +02:00
bcast.h tipc: update a binding service via broadcast 2020-06-17 08:53:34 -07:00
bearer.c tipc: guard against string buffer overrun 2024-10-17 15:11:26 +02:00
bearer.h tipc: add tipc_bearer_min_mtu to calculate min mtu 2023-05-24 17:36:51 +01:00
core.c tipc: fix use-after-free Read in tipc_named_reinit 2022-06-29 09:03:22 +02:00
core.h minmax: add in_range() macro 2025-10-19 16:21:28 +02:00
crypto.c tipc: fix RCU dereference race in tipc_aead_users_dec() 2026-03-04 07:20:34 -05:00
crypto.h net/tipc: fix tipc header files for kernel-doc 2020-12-01 15:37:41 -08:00
diag.c tipc: switch to rhashtable iterator 2018-08-29 18:04:54 -07:00
discover.c tipc: check skb_linearize() return value in tipc_disc_rcv() 2022-12-02 17:41:06 +01:00
discover.h tipc: some cleanups in the file discover.c 2018-03-23 13:12:17 -04:00
eth_media.c tipc: Use is_broadcast_ether_addr() instead of memcmp() 2020-08-03 16:21:46 -07:00
group.c tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG 2026-04-18 10:33:36 +02:00
group.h tipc: update address terminology in code 2020-11-27 17:34:01 -08:00
ib_media.c tipc: introduce variable window congestion control 2019-12-10 17:31:15 -08:00
Kconfig tipc: not enable tipc when ipv6 works as a module 2020-08-16 21:04:55 -07:00
link.c minmax: add in_range() macro 2025-10-19 16:21:28 +02:00
link.h tipc: simplify the finalize work queue 2021-05-18 13:22:09 -07:00
Makefile tipc: remove meaningless assignment in Makefile 2020-01-08 12:38:54 -08:00
monitor.c tipc: fix NULL pointer dereference in tipc_mon_reinit_self() 2025-05-02 07:44:30 +02:00
monitor.h tipc: update mon's self addr when node addr generated 2019-11-12 19:45:45 -08:00
msg.c tipc: fix double-free in tipc_buf_append() 2026-06-01 17:35:40 +02:00
msg.h net: tipc: fix FB_MTU eat two pages 2021-06-28 13:31:57 -07:00
name_distr.c tipc: rate limit warning for received illegal binding update 2022-02-16 12:56:30 +01:00
name_distr.h net/tipc: fix tipc header files for kernel-doc 2020-12-01 15:37:41 -08:00
name_table.c tipc: fix duplicate publication key in tipc_service_insert_publ() 2026-03-04 07:20:23 -05:00
name_table.h tipc: simplify handling of lookup scope during multicast message reception 2021-06-03 14:06:39 -07:00
net.c tipc: Fix use-after-free in tipc_mon_reinit_self(). 2025-12-07 06:09:27 +09:00
net.h tipc: fix a deadlock when flushing scheduled work 2020-09-07 12:08:53 -07:00
netlink.c tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING 2023-11-20 11:08:28 +01:00
netlink.h net: tipc: allocate attrs locally instead of using genl_family_attrbuf in compat_dumpit() 2019-10-06 15:44:47 +02:00
netlink_compat.c tipc: Fix kernel-infoleak due to uninitialized TLV value 2023-11-28 16:56:23 +00:00
node.c tipc: force a dst refcount before doing decryption 2024-07-05 09:14:30 +02:00
node.h tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
socket.c tipc: fix divide-by-zero in tipc_sk_filter_connect() 2026-04-18 10:33:14 +02:00
socket.h tipc: add stricter control of reserved service types 2020-10-30 08:19:18 -07:00
subscr.c tipc:subscr.c: fix a spelling mistake 2021-06-10 13:48:43 -07:00
subscr.h tipc: fix htmldoc and smatch warnings 2021-03-29 16:28:50 -07:00
sysctl.c tipc: add automatic session key exchange 2020-09-18 13:58:37 -07:00
topsrv.c tipc: Fix use-after-free in tipc_conn_close(). 2025-07-17 18:30:46 +02:00
topsrv.h tipc: rename tipc_server to tipc_topsrv 2018-02-16 15:26:34 -05:00
trace.c net/tipc: fix various kernel-doc warnings 2020-12-01 15:37:46 -08:00
trace.h tipc: add support for broadcast rcv stats dumping 2020-05-26 15:16:52 -07:00
udp_media.c tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer 2025-06-27 11:05:36 +01:00
udp_media.h tipc: implement configuration of UDP media MTU 2018-04-20 11:04:05 -04:00