From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8CAEC39E6FF; Mon, 20 Apr 2026 13:05:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776690334; cv=none; b=hnNfpC1+ExMSZBKZ7yVCT4MbFtrO26N+KkKvRN9+gm/U/tF48+EnLzsox9TkPq696iBgj0MB6m2mll+EKz0W/wHxczLg5Dk88zJ4zEct+I/2JveKJvhaGK8CCjVgR4vZ2VWrrASZuZIFTTUBgrlXydhRu4aKtIOOZfpwEc4hvGI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776690334; c=relaxed/simple; bh=2tdnNmWhva210aPxlaXggyu0lNkDimgucQTQrZ/IvEM=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=l4Nsc4ntRTNixwf48kNMjLTQRjgWhCYgpK7QwomO+zl2+CTtVX0adEo2fHzsYNA/P0SXQTyGnULV/Wsu2GwMnN1o1dQJj7JHpSVzaBN6K59QWFhC5X8tY9y19DvojqYAz8hBmAdj+WMvdvrLnBmQwdu+2GKTKhLUV3XCAlL8rjs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=G2sAVYW5; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="G2sAVYW5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 651C8C19425; Mon, 20 Apr 2026 13:05:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1776690334; bh=2tdnNmWhva210aPxlaXggyu0lNkDimgucQTQrZ/IvEM=; h=From:To:Subject:Date:From; b=G2sAVYW50VkKFXdKuo2+trfqqw7NUQ4emzjUSDFdplMP9eMNPc2ub1AMADKJ2bPPU 3A8KrU4IgdjRv/ljhZthRuSOPQVmHURx/LxDOUE7ZqCDUcJewT2mH8LTNmZOVKEfXi iitaAHg/uDSmxmRPdqnf+hpBQ8Hs7Y6+7t/5pP0MHTRu6vMF+OOWcUHXEOk7r/YKSy QdZtOCWAPWGO8L9/CrritOG8IBrarReTXE/lC633fCndfeUXCsk+9cJRKVBiERs1/a rdju4Xvur+XCRqylgnaZ1JL7Na08wdeBwkmldZl9l2XS23v1k2nC4N0fMch2VyO0PC eGY0BkZiUC5bA== From: Lee Jones To: lee@kernel.org, Jon Maloy , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Ying Xue , netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: [PATCH 1/1] tipc: fix double-free in tipc_buf_append() Date: Mon, 20 Apr 2026 14:05:23 +0100 Message-ID: <20260420130524.3527420-1-lee@kernel.org> X-Mailer: git-send-email 2.54.0.rc1.513.gad8abe7a5a-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The tipc_msg_validate() function can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the error handling path would free the original skb pointer, which had already been freed, leading to double-free. Fix this by passing the caller's skb pointer-pointer directly to tipc_msg_validate(), ensuring any modification is reflected correctly. The local skb pointer is then updated from the (possibly modified) caller's pointer. Fixes: d618d09a68e4 ("tipc: enforce valid ratio between skb truesize and contents") Assisted-by: Gemini:gemini-3.1-pro-preview Signed-off-by: Lee Jones --- net/tipc/msg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 76284fc538eb..9f4f612ee027 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -177,8 +177,9 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (fragid == LAST_FRAGMENT) { TIPC_SKB_CB(head)->validated = 0; - if (unlikely(!tipc_msg_validate(&head))) + if (unlikely(!tipc_msg_validate(headbuf))) goto err; + head = *headbuf; *buf = head; TIPC_SKB_CB(head)->tail = NULL; *headbuf = NULL; -- 2.54.0.rc1.513.gad8abe7a5a-goog