In case of GSO, 'chunk->skb' pointer may point to an entry from fraglist created in 'sctp_packet_gso_append()'. To avoid freeing random fraglist entry (and so undefined behavior and/or memory leak), ensure that 'chunk->skb' is set to 'chunk->head_skb' (i.e. fraglist head) before calling 'sctp_chunk_free()'. Reported-by: syzbot+8bb053b5d63595ab47db@xxxxxxxxxxxxxxxxxxxxxxxxx Closes: https://syzkaller.appspot.com/bug?id=0d8351bbe54fd04a492c2daab0164138db008042 Fixes: 90017accff61 ("sctp: Add GSO support") Suggested-by: Xin Long <lucien.xin@xxxxxxxxx> Signed-off-by: Dmitry Antipov <dmantipov@xxxxxxxxx> --- net/sctp/inqueue.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c index 7182c5a450fb..dda5e1ad9cac 100644 --- a/net/sctp/inqueue.c +++ b/net/sctp/inqueue.c @@ -52,8 +52,11 @@ void sctp_inq_free(struct sctp_inq *queue) /* If there is a packet which is currently being worked on, * free it as well. */ - if (queue->in_progress) { - sctp_chunk_free(queue->in_progress); + chunk = queue->in_progress; + if (chunk) { + if (chunk->head_skb) + chunk->skb = chunk->head_skb; + sctp_chunk_free(chunk); queue->in_progress = NULL; } } -- 2.43.0
