From: Eric Dumazet <eric.duma...@gmail.com> Date: Wed, 17 Aug 2016 05:56:26 -0700
> From: Eric Dumazet <eduma...@google.com> > > When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the > tail of the write queue using tcp_add_write_queue_tail() > > Then it attempts to copy user data into this fresh skb. > > If the copy fails, we undo the work and remove the fresh skb. > > Unfortunately, this undo lacks the change done to tp->highest_sack and > we can leave a dangling pointer (to a freed skb) > > Later, tcp_xmit_retransmit_queue() can dereference this pointer and > access freed memory. For regular kernels where memory is not unmapped, > this might cause SACK bugs because tcp_highest_sack_seq() is buggy, > returning garbage instead of tp->snd_nxt, but with various debug > features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. > > This bug was found by Marco Grassi thanks to syzkaller. > > Fixes: 6859d49475d4 ("[TCP]: Abstract tp->highest_sack accessing & point to > next skb") > Reported-by: Marco Grassi <marco....@gmail.com> > Signed-off-by: Eric Dumazet <eduma...@google.com> Applied and queued up for -stable.