• Eric Dumazet's avatar
    tcp: fix use after free in tcp_xmit_retransmit_queue() · bb1fceca
    Eric Dumazet authored
    When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the
    tail of the write queue using tcp_add_write_queue_tail()
    
    Then it attempts to copy user data into this fresh skb.
    
    If the copy fails, we undo the work and remove the fresh skb.
    
    Unfortunately, this undo lacks the change done to tp->highest_sack and
    we can leave a dangling pointer (to a freed skb)
    
    Later, tcp_xmit_retransmit_queue() can dereference this pointer and
    access freed memory. For regular kernels where memory is not unmapped,
    this might cause SACK bugs because tcp_highest_sack_seq() is buggy,
    returning garbage instead of tp->snd_nxt, but with various debug
    features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.
    
    This bug was found by Marco Grassi thanks to syzkaller.
    
    Fixes: 6859d494 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb")
    Reported-by: 's avatarMarco Grassi <marco.gra@gmail.com>
    Signed-off-by: 's avatarEric Dumazet <edumazet@google.com>
    Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Acked-by: 's avatarNeal Cardwell <ncardwell@google.com>
    Reviewed-by: 's avatarCong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: 's avatarDavid S. Miller <davem@davemloft.net>
    bb1fceca
tcp.h 55.7 KB