On Fri, 23 Jul 2021 19:36:11 +0300 Pavel Skripkin <paskripkin@xxxxxxxxx> wrote: > On Sun, 18 Jul 2021 10:15:19 -0700 > syzbot <syzbot+e6741b97d5552f97c24d@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote: > > > Hello, > > > > syzbot found the following issue on: > > > > HEAD commit: ab0441b4a920 Merge branch 'vmxnet3-version-6' > > git tree: net-next > > console output: > > https://syzkaller.appspot.com/x/log.txt?x=1744ac6a300000 kernel > > config: https://syzkaller.appspot.com/x/.config?x=da140227e4f25b17 > > dashboard link: > > https://syzkaller.appspot.com/bug?extid=e6741b97d5552f97c24d syz > > repro: > > https://syzkaller.appspot.com/x/repro.syz?x=13973a74300000 C > > reproducer: > > https://syzkaller.appspot.com/x/repro.c?x=17ffc902300000 > > > > The issue was bisected to: > > > > commit 67a3156453859ceb40dc4448b7a6a99ea0ad27c7 > > Author: Rob Herring <robh@xxxxxxxxxx> > > Date: Thu May 27 19:45:47 2021 +0000 > > > > of: Merge of_address_to_resource() and > > of_pci_address_to_resource() implementations > > > > bisection log: > > https://syzkaller.appspot.com/x/bisect.txt?x=129b0438300000 final > > oops: > > https://syzkaller.appspot.com/x/report.txt?x=119b0438300000 console > > output: https://syzkaller.appspot.com/x/log.txt?x=169b0438300000 > > > > IMPORTANT: if you fix the issue, please add the following tag to the > > commit: Reported-by: > > syzbot+e6741b97d5552f97c24d@xxxxxxxxxxxxxxxxxxxxxxxxx Fixes: > > 67a315645385 ("of: Merge of_address_to_resource() and > > of_pci_address_to_resource() implementations") > > > > ================================================================== > > BUG: KASAN: use-after-free in tipc_recvmsg+0xf77/0xf90 > > net/tipc/socket.c:1979 Read of size 4 at addr ffff8880328cf1c0 by > > task kworker/u4:0/8 > > > > Since code accesing skb_cb after possible kfree_skb() call let's just > store bytes_read to variable and use it instead of acessing > skb_cb->bytes_read > > #syz test > git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git > master > > Oops... The buggy code is in -next tree. #syz test git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master With regards, Pavel Skripkin
>From 9f81f8574bfc1183209022b405848e01c35b86e6 Mon Sep 17 00:00:00 2001 From: Pavel Skripkin <paskripkin@xxxxxxxxx> Date: Fri, 23 Jul 2021 19:34:06 +0300 Subject: [PATCH] tipc: fix use-after-free in tipc_recvmsg /* .. */ Signed-off-by: Pavel Skripkin <paskripkin@xxxxxxxxx> --- net/tipc/socket.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 9b0b311c7ec1..0cf2468d209d 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1886,6 +1886,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, struct sk_buff *skb; bool grp_evt; long timeout; + unsigned int bytes_read; /* Catch invalid receive requests */ if (unlikely(!buflen)) @@ -1973,10 +1974,13 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, tipc_node_distr_xmit(sock_net(sk), &xmitq); } - if (!skb_cb->bytes_read) + /* To avoid accesing skb_cb after tsk_advance_rx_queue */ + bytes_read = skb_cb->bytes_read; + + if (!bytes_read) tsk_advance_rx_queue(sk); - if (likely(!connected) || skb_cb->bytes_read) + if (likely(!connected) || bytes_read) goto exit; /* Send connection flow control advertisement when applicable */ -- 2.32.0
