Re: [Patch net] tipc: fix the skb_unshare() in tipc_buf_append()

2020-10-09 Thread Jakub Kicinski
On Wed, 7 Oct 2020 21:12:50 -0700 Cong Wang wrote: > skb_unshare() drops a reference count on the old skb unconditionally, > so in the failure case, we end up freeing the skb twice here. > And because the skb is allocated in fclone and cloned by caller > tipc_msg_reassemble(), the consequence is a

Re: [Patch net] tipc: fix the skb_unshare() in tipc_buf_append()

2020-10-08 Thread Xin Long
On Fri, Oct 9, 2020 at 1:45 AM Cong Wang wrote: > > On Thu, Oct 8, 2020 at 1:45 AM Xin Long wrote: > > > > On Thu, Oct 8, 2020 at 12:12 PM Cong Wang wrote: > > > > > > skb_unshare() drops a reference count on the old skb unconditionally, > > > so in the failure case, we end up freeing the skb tw

Re: [Patch net] tipc: fix the skb_unshare() in tipc_buf_append()

2020-10-08 Thread Cong Wang
On Thu, Oct 8, 2020 at 1:45 AM Xin Long wrote: > > On Thu, Oct 8, 2020 at 12:12 PM Cong Wang wrote: > > > > skb_unshare() drops a reference count on the old skb unconditionally, > > so in the failure case, we end up freeing the skb twice here. > > And because the skb is allocated in fclone and cl

Re: [Patch net] tipc: fix the skb_unshare() in tipc_buf_append()

2020-10-08 Thread Xin Long
On Thu, Oct 8, 2020 at 12:12 PM Cong Wang wrote: > > skb_unshare() drops a reference count on the old skb unconditionally, > so in the failure case, we end up freeing the skb twice here. > And because the skb is allocated in fclone and cloned by caller > tipc_msg_reassemble(), the consequence is a

[Patch net] tipc: fix the skb_unshare() in tipc_buf_append()

2020-10-07 Thread Cong Wang
skb_unshare() drops a reference count on the old skb unconditionally, so in the failure case, we end up freeing the skb twice here. And because the skb is allocated in fclone and cloned by caller tipc_msg_reassemble(), the consequence is actually freeing the original skb too, thus triggered the UAF