On Sun, 18 Jul 2021 10:15:19 -0700 syzbot <syzbot+e6741b97d5552f97c24d@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: ab0441b4a920 Merge branch 'vmxnet3-version-6' > git tree: net-next > console output: > https://syzkaller.appspot.com/x/log.txt?x=1744ac6a300000 kernel > config: https://syzkaller.appspot.com/x/.config?x=da140227e4f25b17 > dashboard link: > https://syzkaller.appspot.com/bug?extid=e6741b97d5552f97c24d syz > repro: > https://syzkaller.appspot.com/x/repro.syz?x=13973a74300000 C > reproducer: https://syzkaller.appspot.com/x/repro.c?x=17ffc902300000 > > The issue was bisected to: > > commit 67a3156453859ceb40dc4448b7a6a99ea0ad27c7 > Author: Rob Herring <robh@xxxxxxxxxx> > Date: Thu May 27 19:45:47 2021 +0000 > > of: Merge of_address_to_resource() and > of_pci_address_to_resource() implementations > > bisection log: > https://syzkaller.appspot.com/x/bisect.txt?x=129b0438300000 final > oops: https://syzkaller.appspot.com/x/report.txt?x=119b0438300000 > console output: > https://syzkaller.appspot.com/x/log.txt?x=169b0438300000 > > IMPORTANT: if you fix the issue, please add the following tag to the > commit: Reported-by: > syzbot+e6741b97d5552f97c24d@xxxxxxxxxxxxxxxxxxxxxxxxx Fixes: > 67a315645385 ("of: Merge of_address_to_resource() and > of_pci_address_to_resource() implementations") > > ================================================================== > BUG: KASAN: use-after-free in tipc_recvmsg+0xf77/0xf90 > net/tipc/socket.c:1979 Read of size 4 at addr ffff8880328cf1c0 by > task kworker/u4:0/8 > Since code accesing skb_cb after possible kfree_skb() call let's just store bytes_read to variable and use it instead of acessing skb_cb->bytes_read #syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master With regards, Pavel Skripkin
>From 9f81f8574bfc1183209022b405848e01c35b86e6 Mon Sep 17 00:00:00 2001 From: Pavel Skripkin <paskripkin@xxxxxxxxx> Date: Fri, 23 Jul 2021 19:34:06 +0300 Subject: [PATCH] tipc: fix use-after-free in tipc_recvmsg /* .. */ Signed-off-by: Pavel Skripkin <paskripkin@xxxxxxxxx> --- net/tipc/socket.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 9b0b311c7ec1..0cf2468d209d 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1886,6 +1886,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, struct sk_buff *skb; bool grp_evt; long timeout; + unsigned int bytes_read; /* Catch invalid receive requests */ if (unlikely(!buflen)) @@ -1973,10 +1974,13 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, tipc_node_distr_xmit(sock_net(sk), &xmitq); } - if (!skb_cb->bytes_read) + /* To avoid accesing skb_cb after tsk_advance_rx_queue */ + bytes_read = skb_cb->bytes_read; + + if (!bytes_read) tsk_advance_rx_queue(sk); - if (likely(!connected) || skb_cb->bytes_read) + if (likely(!connected) || bytes_read) goto exit; /* Send connection flow control advertisement when applicable */ -- 2.32.0
