Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Eric Dumazet bb1fceca22 tcp: fix use after free in tcp_xmit_retransmit_queue() ... When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the tail of the write queue using tcp_add_write_queue_tail() Then it attempts to copy user data into this fresh skb. If the copy fails, we undo the work and remove the fresh skb. Unfortunately, this undo lacks the change done to tp->highest_sack and we can leave a dangling pointer (to a freed skb) Later, tcp_xmit_retransmit_queue() can dereference this pointer and access freed memory. For regular kernels where memory is not unmapped, this might cause SACK bugs because tcp_highest_sack_seq() is buggy, returning garbage instead of tp->snd_nxt, but with various debug features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. This bug was found by Marco Grassi thanks to syzkaller. Fixes: 6859d49475 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb") Reported-by: Marco Grassi <marco.gra@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Cc: Yuchung Cheng <ycheng@google.com> Cc: Neal Cardwell <ncardwell@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		History 2016-08-18 23:22:57 -07:00
..
9p	9p: switch p9_client_read() to passing struct iov_iter *	2015-04-11 22:28:27 -04:00
bluetooth	Bluetooth: Add debugfs fields for hardware and firmware info	2016-07-18 09:33:28 +03:00
caif
irda	irda: Convert function pointer arrays and uses to const	2014-12-10 15:33:16 -05:00
iucv	s390/iucv: do not use arrays as argument	2015-09-21 16:03:04 -07:00
netfilter
netns	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2016-06-01 17:54:19 -07:00
nfc
phonet
sctp
tc_act
6lowpan.h	6lowpan: add 802.15.4 short addr slaac	2016-06-15 20:41:22 -07:00
act_api.h	net_sched: convert tcf_exts from list to pointer array	2016-08-17 19:27:51 -04:00
addrconf.h
af_ieee802154.h	ieee802154: af_ieee802154: fix typo in comment.	2015-09-17 13:20:05 +02:00
af_rxrpc.h
af_unix.h
af_vsock.h	VSOCK: Introduce virtio_vsock_common.ko	2016-08-02 02:57:29 +03:00
ah.h
arp.h	neigh: Factor out ___neigh_lookup_noref	2015-03-04 00:23:23 -05:00
atmclip.h	atm: clip: Use device neigh support on top of "arp_tbl".	2011-11-30 18:51:03 -05:00
ax25.h
ax88796.h	ax88796: Add method to take MAC from platform data	2009-03-24 23:32:03 -07:00
bond_3ad.h	bonding: 3ad: apply ad_actor settings changes immediately	2016-02-09 04:45:49 -05:00
bond_alb.h
bond_options.h	bonding: convert num_grat_arp to the new bonding option API	2015-07-27 01:05:24 -07:00
bonding.h
busy_poll.h
calipso.h
cfg80211-wext.h
cfg80211.h	cfg80211: Add mesh peer AID setting API	2016-07-06 15:04:52 +02:00
cfg802154.h	ieee802154: add netns support	2016-07-08 12:20:57 +02:00
checksum.h
cipso_ipv4.h
cls_cgroup.h	cls_cgroup: get sk_classid only from full sockets	2016-04-19 20:09:25 -04:00
codel.h
codel_impl.h	codel: split into multiple files	2016-04-25 16:44:27 -04:00
codel_qdisc.h
compat.h
datalink.h
dcbevent.h
dcbnl.h	net/dcb: Add IEEE QCN attribute	2015-03-06 21:50:02 -05:00
devlink.h	net/devlink: Add E-Switch mode control	2016-07-02 14:40:40 -04:00
dn.h	net: Move prototype declaration to header file include/net/dn.h from net/decnet/af_decnet.c	2014-02-09 17:32:49 -08:00
dn_dev.h
dn_fib.h
dn_neigh.h	netfilter: Pass net into okfn	2015-09-17 17:18:37 -07:00
dn_nsp.h	decnet (dn*.h): Remove extern from function prototypes	2013-09-20 14:49:32 -04:00
dn_route.h
dsa.h
dsfield.h
dst.h
dst_cache.h	net: add dst_cache support	2016-02-16 20:21:48 -05:00
dst_metadata.h
dst_ops.h
esp.h	net: move pskb_put() to core code	2013-11-07 19:28:58 -05:00
ethoc.h
fib_rules.h
firewire.h
flow.h
flow_dissector.h
flowcache.h	flowcache: Make flow cache name space aware	2014-02-12 07:02:11 +01:00
fou.h
fq.h
fq_impl.h	fq: split out backlog update logic	2016-04-28 17:03:38 -04:00
garp.h
gen_stats.h
genetlink.h
geneve.h
gre.h
gro_cells.h
gtp.h
gue.h	gue: Protocol constants for remote checksum offload	2014-11-05 16:30:03 -05:00
hwbm.h
icmp.h	net: snmp: kill STATS_BH macros	2016-04-27 22:48:25 -04:00
ieee80211_radiotap.h	mac80211: propagate STBC / LDPC flags to radiotap	2014-02-06 09:34:58 +01:00
ieee802154_netdev.h
if_inet6.h
ila.h
inet6_connection_sock.h
inet6_hashtables.h
inet_common.h
inet_connection_sock.h
inet_ecn.h
inet_frag.h
inet_hashtables.h
inet_sock.h
inet_timewait_sock.h
inetpeer.h
ip.h
ip6_checksum.h
ip6_fib.h
ip6_route.h	net: ipv6: Move ip6_route_get_saddr to inline	2016-06-17 21:25:29 -07:00
ip6_tunnel.h
ip_fib.h
ip_tunnels.h
ip_vs.h
ipcomp.h
ipconfig.h
ipv6.h	Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/selinux into next	2016-07-07 10:15:34 +10:00
ipx.h
iw_handler.h	cfg80211/wext: fix message ordering	2016-01-29 17:13:43 +01:00
kcm.h	kcm: mark helper functions inline	2016-03-10 14:42:03 -05:00
l3mdev.h
lapb.h
lib80211.h
llc.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h	net: Pass kern from net_proto_family.create to sk_alloc	2015-05-11 10:50:17 -04:00
llc_if.h
llc_pdu.h	net: llc: fix order of evaluation in llc_conn_ac_inc_vr_by_1	2014-01-01 22:22:43 -05:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h	llc*.h: Remove extern from function prototypes	2013-09-21 14:01:38 -04:00
lwtunnel.h	lwtunnel: autoload of lwt modules	2016-02-21 22:00:28 -05:00
mac80211.h	mac80211: Add ieee80211_hw pointer to get_expected_throughput	2016-08-05 14:23:25 +02:00
mac802154.h
mip6.h
mld.h	ipv6: mld: answer mldv2 queries with mldv1 reports in mldv1 fallback	2014-09-22 16:23:15 -04:00
mpls.h
mpls_iptunnel.h	mpls: multipath route support	2015-10-23 06:26:42 -07:00
mrp.h
ncsi.h
ndisc.h
neighbour.h
net_namespace.h	treewide: replace obsolete _refok by __ref	2016-08-02 17:31:41 -04:00
net_ratelimit.h
netevent.h
netlabel.h	netlabel: Implement CALIPSO config functions for SMACK.	2016-06-27 15:06:18 -04:00
netlink.h	netlink: kill nla_put_u64()	2016-05-16 13:46:23 -04:00
netprio_cgroup.h
netrom.h
nexthop.h
nl802154.h	ieee802154: add netns support	2016-07-08 12:20:57 +02:00
p8022.h	p8022.h: Remove extern from function prototypes	2013-09-21 14:01:39 -04:00
ping.h
pkt_cls.h
pkt_sched.h	net_sched: remove generic throttled management	2016-06-10 23:58:21 -07:00
protocol.h	udp: Remove udp_offloads	2016-04-07 16:53:30 -04:00
psnap.h
raw.h
rawv6.h	raw/rawv6.h: Remove extern from function prototypes	2013-09-23 01:51:08 -04:00
red.h
regulatory.h	cfg80211: allow wiphy specific regdomain management	2014-12-17 11:49:55 +01:00
request_sock.h
rose.h	rose.h: Remove extern from function prototypes	2013-09-23 01:51:08 -04:00
route.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-04-23 18:51:33 -04:00
rtnetlink.h
sch_generic.h	net_sched: generalize bulk dequeue	2016-06-25 12:19:35 -04:00
scm.h
secure_seq.h
slhc_vj.h	[NET]: Remove __ARGS from include/net/slhc_vj.h	2005-07-05 15:12:04 -07:00
snmp.h
sock.h	dccp: limit sk_filter trim to payload	2016-07-13 11:53:41 -07:00
sock_reuseport.h	soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind	2016-01-19 14:44:23 -05:00
Space.h	drivers: net: Include new header file in sbni.c	2013-12-19 18:51:20 -05:00
stp.h	stp.h: Remove extern from function prototypes	2013-09-23 01:51:09 -04:00
switchdev.h
tcp.h
tcp_states.h	inet: add TCP_NEW_SYN_RECV state	2015-03-12 22:58:12 -04:00
timewait_sock.h
transp_v6.h	ipv6: add new struct ipcm6_cookie	2016-05-03 16:08:14 -04:00
tso.h	net: tso: add support for IPv6	2015-10-26 22:24:22 -07:00
udp.h
udp_tunnel.h
udplite.h
vsock_addr.h
vxlan.h	net: Remove deprecated tunnel specific UDP offload functions	2016-06-17 20:23:32 -07:00
wext.h
wimax.h
x25.h
x25device.h	X25: Add if_x25.h and x25 to device identifiers	2010-04-22 16:12:36 -07:00
xfrm.h