This is a note to let you know that I've just added the patch titled tipc: fix the skb_unshare() in tipc_buf_append() to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tipc-fix-the-skb_unshare-in-tipc_buf_append.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Sat Oct 17 01:06:13 PM CEST 2020 From: Cong Wang <xiyou.wangcong@xxxxxxxxx> Date: Wed, 7 Oct 2020 21:12:50 -0700 Subject: tipc: fix the skb_unshare() in tipc_buf_append() From: Cong Wang <xiyou.wangcong@xxxxxxxxx> [ Upstream commit ed42989eab57d619667d7e87dfbd8fe207db54fe ] skb_unshare() drops a reference count on the old skb unconditionally, so in the failure case, we end up freeing the skb twice here. And because the skb is allocated in fclone and cloned by caller tipc_msg_reassemble(), the consequence is actually freeing the original skb too, thus triggered the UAF by syzbot. Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy(). Fixes: ff48b6222e65 ("tipc: use skb_unshare() instead in tipc_buf_append()") Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@xxxxxxxxxxxxxxxxxxxxxxxxx Cc: Jon Maloy <jmaloy@xxxxxxxxxx> Cc: Ying Xue <ying.xue@xxxxxxxxxxxxx> Signed-off-by: Cong Wang <xiyou.wangcong@xxxxxxxxx> Reviewed-by: Xin Long <lucien.xin@xxxxxxxxx> Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/tipc/msg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -138,7 +138,8 @@ int tipc_buf_append(struct sk_buff **hea if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - frag = skb_unshare(frag, GFP_ATOMIC); + if (skb_cloned(frag)) + frag = skb_copy(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; head = *headbuf = frag; Patches currently in stable-queue which might be from xiyou.wangcong@xxxxxxxxx are queue-4.4/tipc-fix-the-skb_unshare-in-tipc_buf_append.patch