This is a note to let you know that I've just added the patch titled [PATCH stable 5.8 21/22] tipc: fix memory leak caused by tipc_buf_append() to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tipc-fix-memory-leak-caused-by-tipc_buf_append.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Sat Oct 31 10:28:22 AM CET 2020 From: Tung Nguyen <tung.q.nguyen@xxxxxxxxxxxxxx> Date: Tue, 27 Oct 2020 10:24:03 +0700 Subject: [PATCH stable 5.8 21/22] tipc: fix memory leak caused by tipc_buf_append() From: Tung Nguyen <tung.q.nguyen@xxxxxxxxxxxxxx> [ Upstream commit ceb1eb2fb609c88363e06618b8d4bbf7815a4e03 ] Commit ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") replaced skb_unshare() with skb_copy() to not reduce the data reference counter of the original skb intentionally. This is not the correct way to handle the cloned skb because it causes memory leak in 2 following cases: 1/ Sending multicast messages via broadcast link The original skb list is cloned to the local skb list for local destination. After that, the data reference counter of each skb in the original list has the value of 2. This causes each skb not to be freed after receiving ACK: tipc_link_advance_transmq() { ... /* release skb */ __skb_unlink(skb, &l->transmq); kfree_skb(skb); <-- memory exists after being freed } 2/ Sending multicast messages via replicast link Similar to the above case, each skb cannot be freed after purging the skb list: tipc_mcast_xmit() { ... __skb_queue_purge(pkts); <-- memory exists after being freed } This commit fixes this issue by using skb_unshare() instead. Besides, to avoid use-after-free error reported by KASAN, the pointer to the fragment is set to NULL before calling skb_unshare() to make sure that the original skb is not freed after freeing the fragment 2 times in case skb_unshare() returns NULL. Fixes: ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") Acked-by: Jon Maloy <jmaloy@xxxxxxxxxx> Reported-by: Thang Hoang Ngo <thang.h.ngo@xxxxxxxxxxxxxx> Signed-off-by: Tung Nguyen <tung.q.nguyen@xxxxxxxxxxxxxx> Reviewed-by: Xin Long <lucien.xin@xxxxxxxxx> Acked-by: Cong Wang <xiyou.wangcong@xxxxxxxxx> Link: https://lore.kernel.org/r/20201027032403.1823-1-tung.q.nguyen@xxxxxxxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/tipc/msg.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -140,12 +140,11 @@ int tipc_buf_append(struct sk_buff **hea if (fragid == FIRST_FRAGMENT) { if (unlikely(head)) goto err; - if (skb_cloned(frag)) - frag = skb_copy(frag, GFP_ATOMIC); + *buf = NULL; + frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; head = *headbuf = frag; - *buf = NULL; TIPC_SKB_CB(head)->tail = NULL; if (skb_is_nonlinear(head)) { skb_walk_frags(head, tail) { Patches currently in stable-queue which might be from tung.q.nguyen@xxxxxxxxxxxxxx are queue-4.19/tipc-fix-memory-leak-caused-by-tipc_buf_append.patch