Re: BUG: KASAN: double-free or invalid-free in ip_defrag after upgrade from 4.19.13

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Wed, Jan 30, 2019 at 03:16:56PM -0800, Eric Dumazet wrote:
> On Wed, Jan 30, 2019 at 3:13 PM Eric Dumazet <edumazet@google.com> wrote:
> >
> > On Wed, Jan 30, 2019 at 3:09 PM Ivan Babrou <ivan@cloudflare.com> wrote:
> > >
> > > Eric,
> > >
> > > Are you going to propose the change then?
> > >
> > > I'm happy to test it out.
> > >
> >
> > This is indeed a bug in linux stable tree only.
> >
> > The err=-EINVAL move was part of a patch that was not backported
> > (since it was not a bug fix)
> >
> > commit 0ff89efb524631ac9901b81446b453c29711c376
> > Author: Peter Oskolkov <posk@google.com>
> > Date:   Tue Aug 28 11:36:19 2018 -0700
> >
> >     ip: fail fast on IP defrag errors
> >
> >
> 
> Greg, the fix for 4.19 (and maybe other stable trees ?) would be :
> 
> diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
> index f8bbd693c19c247e41839c2d0b5318ca51b23ee8..d95b32af4a0e3f552405c9e61cc372729834160c
> 100644
> --- a/net/ipv4/ip_fragment.c
> +++ b/net/ipv4/ip_fragment.c
> @@ -425,6 +425,7 @@ static int ip_frag_queue(struct ipq *qp, struct
> sk_buff *skb)
>          * fragment.
>          */
> 
> +       err = -EINVAL;
>         /* Find out where to put this fragment.  */
>         prev_tail = qp->q.fragments_tail;
>         if (!prev_tail)
> @@ -501,7 +502,6 @@ static int ip_frag_queue(struct ipq *qp, struct
> sk_buff *skb)
> 
>  discard_qp:
>         inet_frag_kill(&qp->q);
> -       err = -EINVAL;
>         __IP_INC_STATS(net, IPSTATS_MIB_REASM_OVERLAPS);
>  err:
>         kfree_skb(skb);
> 

Thanks for this, I'll turn this into a real patch and backport it to
where it is needed.

greg k-h