Received: by 2002:a05:6a11:4021:0:0:0:0 with SMTP id ky33csp2350508pxb; Mon, 20 Sep 2021 19:45:37 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz6fbcVtme+qb6YZCK8f0nT/4QG9LVj9+3YR8T+qA4AG0QKcspJQgu9YKLtR7Knk7ObmyES X-Received: by 2002:a05:6602:1581:: with SMTP id e1mr21307993iow.49.1632192337359; Mon, 20 Sep 2021 19:45:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1632192337; cv=none; d=google.com; s=arc-20160816; b=1CANJl5wkQqBqU+QKQd2rtvSE5cB11517QXzrwfo8yxPVXDcXtjvPg700M7fp1iPiv Qd2U5AAkvmVqRhMxQ1YNxqaMfZqqit6hx8ducO69KZlCIqeS3N0KPQ5D5bccuHFA1qid IA//GWvdBIxvlm8K3GbSstwVA3TrK9+zXrZvYz701YZ8+Lpx+Ci/EKyyLdeY6yer+HP/ 7BsIYoN3lYaysOG5e7ARrNtuawvGB8YWcIPYhNDZtuqVV3nQzK1xynoOoTwhdaUZ56l6 /Yb7kdG/rIRRcdbFnZwO26VJpAT5pWP0O6KabNM9ENkFQ/PBg2EQt/CgDiXo+apreAFR 9ZkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=MvsU/uHs7u7pab9f5JguxyQMZladvHOyyBkqIrqllxs=; b=XtVXE4JfIsMJYZJYH+j12A/rFNNFfBuP0R9C9skYUoCoFX1uRGm+kaAUiMJwbM5X68 BeY4Rw5si908mFxRCK0oKnaftnNpzraM8yX0L91hs+iunJt9+fCq6FBPQxOpwMeqLnoa y5bByE4bife8zU7eTCV2g+42nSeOlDQnAbvXb/1aCATZfAtmfZU7uacnC1rBc1IB5w0V E5JpGg4h3jMlMTmyPjhTIWymbn6MS3+VvZH713o+6mq5VwD27kHdAKfRKCX5rAsoO0cP WV/XJC6DxdySfKcYl9fuEI8eiIbMx2UTb9A8fMuWQkfTh7DYTAuXYWXKDpIM+feXo8LV hlQA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=D6kbSsLS; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l2si9736774iln.84.2021.09.20.19.45.26; Mon, 20 Sep 2021 19:45:37 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=D6kbSsLS; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378797AbhITS02 (ORCPT + 99 others); Mon, 20 Sep 2021 14:26:28 -0400 Received: from mail.kernel.org ([198.145.29.99]:41848 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351462AbhITSSP (ORCPT ); Mon, 20 Sep 2021 14:18:15 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 4CEA4632A2; Mon, 20 Sep 2021 17:22:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1632158553; bh=GYqZbqkLQ4C4Ds8JdpEkexRz/rAqdZNfCAd97Sy5WmQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D6kbSsLS2+dmXkLtT/lmXzC/GKJxwbXn39iyr6Jysthm+4zX5HCOy98eUqXpPJRn/ /lj6Vq9W4PuuhQ19Vc/wJ4syrk+Y1J4dVYcM6wnh/JR1UOrYzJnqihDWuecbwVBxkL jSP6RnDfaaIHlh2vrNcKwd9rzexBOOpxj9JRi0GY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+e6741b97d5552f97c24d@syzkaller.appspotmail.com, Xin Long , Jon Maloy , "David S. Miller" Subject: [PATCH 5.4 209/260] tipc: fix an use-after-free issue in tipc_recvmsg Date: Mon, 20 Sep 2021 18:43:47 +0200 Message-Id: <20210920163938.211574882@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210920163931.123590023@linuxfoundation.org> References: <20210920163931.123590023@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Xin Long commit cc19862ffe454a5b632ca202e5a51bfec9f89fd2 upstream. syzbot reported an use-after-free crash: BUG: KASAN: use-after-free in tipc_recvmsg+0xf77/0xf90 net/tipc/socket.c:1979 Call Trace: tipc_recvmsg+0xf77/0xf90 net/tipc/socket.c:1979 sock_recvmsg_nosec net/socket.c:943 [inline] sock_recvmsg net/socket.c:961 [inline] sock_recvmsg+0xca/0x110 net/socket.c:957 tipc_conn_rcv_from_sock+0x162/0x2f0 net/tipc/topsrv.c:398 tipc_conn_recv_work+0xeb/0x190 net/tipc/topsrv.c:421 process_one_work+0x98d/0x1630 kernel/workqueue.c:2276 worker_thread+0x658/0x11f0 kernel/workqueue.c:2422 As Hoang pointed out, it was caused by skb_cb->bytes_read still accessed after calling tsk_advance_rx_queue() to free the skb in tipc_recvmsg(). This patch is to fix it by accessing skb_cb->bytes_read earlier than calling tsk_advance_rx_queue(). Fixes: f4919ff59c28 ("tipc: keep the skb in rcv queue until the whole data is read") Reported-by: syzbot+e6741b97d5552f97c24d@syzkaller.appspotmail.com Signed-off-by: Xin Long Acked-by: Jon Maloy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/tipc/socket.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1849,10 +1849,12 @@ static int tipc_recvmsg(struct socket *s tipc_node_distr_xmit(sock_net(sk), &xmitq); } - if (!skb_cb->bytes_read) - tsk_advance_rx_queue(sk); + if (skb_cb->bytes_read) + goto exit; + + tsk_advance_rx_queue(sk); - if (likely(!connected) || skb_cb->bytes_read) + if (likely(!connected)) goto exit; /* Send connection flow control advertisement when applicable */