| Message ID | 20240206092619.74018-1-dmantipov@yandex.ru (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: sctp: fix skb leak in sctp_inq_free() | expand |
On Tue, 6 Feb 2024 12:26:17 +0300 Dmitry Antipov wrote: > In case of GSO, 'chunk->skb' pointer may point to an entry from > fraglist created in 'sctp_packet_gso_append()'. To avoid freeing > random fraglist entry (and so undefined behavior and/or memory > leak), ensure that 'chunk->skb' is set to 'chunk->head_skb' > (i.e. fraglist head) before calling 'sctp_chunk_free()'. The code already exists in another place in this file, let's factor it out to a helper function.
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c index 7182c5a450fb..dda5e1ad9cac 100644 --- a/net/sctp/inqueue.c +++ b/net/sctp/inqueue.c @@ -52,8 +52,11 @@ void sctp_inq_free(struct sctp_inq *queue) /* If there is a packet which is currently being worked on, * free it as well. */ - if (queue->in_progress) { - sctp_chunk_free(queue->in_progress); + chunk = queue->in_progress; + if (chunk) { + if (chunk->head_skb) + chunk->skb = chunk->head_skb; + sctp_chunk_free(chunk); queue->in_progress = NULL; } }
In case of GSO, 'chunk->skb' pointer may point to an entry from fraglist created in 'sctp_packet_gso_append()'. To avoid freeing random fraglist entry (and so undefined behavior and/or memory leak), ensure that 'chunk->skb' is set to 'chunk->head_skb' (i.e. fraglist head) before calling 'sctp_chunk_free()'. Reported-by: syzbot+8bb053b5d63595ab47db@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=0d8351bbe54fd04a492c2daab0164138db008042 Fixes: 90017accff61 ("sctp: Add GSO support") Suggested-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> --- net/sctp/inqueue.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)