From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:34681 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754128AbbLKUWC (ORCPT ); Fri, 11 Dec 2015 15:22:02 -0500 Subject: Patch "af_unix: don't append consumed skbs to sk_receive_queue" has been added to the 4.2-stable tree To: hannes@stressinduktion.org, davem@davemloft.net, dvyukov@google.com, edumazet@google.com, eric.dumazet@gmail.com, gregkh@linuxfoundation.org Cc: , From: Date: Fri, 11 Dec 2015 08:49:01 -0800 Message-ID: <1449852541197241@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled af_unix: don't append consumed skbs to sk_receive_queue to the 4.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: af_unix-don-t-append-consumed-skbs-to-sk_receive_queue.patch and it can be found in the queue-4.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Fri Dec 11 11:38:35 EST 2015 From: Hannes Frederic Sowa Date: Mon, 16 Nov 2015 16:25:56 +0100 Subject: af_unix: don't append consumed skbs to sk_receive_queue From: Hannes Frederic Sowa [ Upstream commit 8844f97238ca6c1ca92a5d6c69f53efd361a266f ] In case multiple writes to a unix stream socket race we could end up in a situation where we pre-allocate a new skb for use in unix_stream_sendpage but have to free it again in the locked section because another skb has been appended meanwhile, which we must use. Accidentally we didn't clear the pointer after consuming it and so we touched freed memory while appending it to the sk_receive_queue. So, clear the pointer after consuming the skb. This bug has been found with syzkaller (http://github.com/google/syzkaller) by Dmitry Vyukov. Fixes: 869e7c62486e ("net: af_unix: implement stream sendpage support") Reported-by: Dmitry Vyukov Cc: Dmitry Vyukov Cc: Eric Dumazet Signed-off-by: Hannes Frederic Sowa Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/unix/af_unix.c | 1 + 1 file changed, 1 insertion(+) --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1799,6 +1799,7 @@ alloc_skb: * this - does no harm */ consume_skb(newskb); + newskb = NULL; } if (skb_append_pagefrags(skb, page, offset, size)) { Patches currently in stable-queue which might be from hannes@stressinduktion.org are queue-4.2/ipv6-add-complete-rcu-protection-around-np-opt.patch queue-4.2/ipv6-check-rt-dst.from-for-the-dst_nocache-route.patch queue-4.2/af-unix-passcred-support-for-sendpage.patch queue-4.2/af_unix-don-t-append-consumed-skbs-to-sk_receive_queue.patch queue-4.2/ipv6-avoid-creating-rtf_cache-from-a-rt-that-is-not-managed-by-fib6-tree.patch queue-4.2/net-scm-fix-pax-detected-msg_controllen-overflow-in-scm_detach_fds.patch queue-4.2/ipv6-check-expire-on-dst_nocache-route.patch queue-4.2/af-unix-fix-use-after-free-with-concurrent-readers-while-splicing.patch queue-4.2/ip_tunnel-disable-preemption-when-updating-per-cpu-tstats.patch queue-4.2/af_unix-take-receive-queue-lock-while-appending-new-skb.patch