Eric Dumazet bb1fceca22 tcp: fix use after free in tcp_xmit_retransmit_queue() ... When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the tail of the write queue using tcp_add_write_queue_tail() Then it attempts to copy user data into this fresh skb. If the copy fails, we undo the work and remove the fresh skb. Unfortunately, this undo lacks the change done to tp->highest_sack and we can leave a dangling pointer (to a freed skb) Later, tcp_xmit_retransmit_queue() can dereference this pointer and access freed memory. For regular kernels where memory is not unmapped, this might cause SACK bugs because tcp_highest_sack_seq() is buggy, returning garbage instead of tp->snd_nxt, but with various debug features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel. This bug was found by Marco Grassi thanks to syzkaller. Fixes: 6859d49475 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb") Reported-by: Marco Grassi <marco.gra@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Cc: Yuchung Cheng <ycheng@google.com> Cc: Neal Cardwell <ncardwell@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-08-18 23:22:57 -07:00
..
9p	…
bluetooth	Bluetooth: Add debugfs fields for hardware and firmware info	2016-07-18 09:33:28 +03:00
caif	…
irda	…
iucv	…
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2016-07-24 22:02:36 -07:00
netns	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2016-06-01 17:54:19 -07:00
nfc	NFC: digital: Add support for NFC DEP Response Waiting Time	2016-07-11 02:01:14 +02:00
phonet	…
sctp	sctp: change to use TCP_CLOSE_WAIT as SCTP_SS_CLOSING	2016-08-01 13:32:50 -07:00
tc_act	net_sched: get rid of struct tcf_common	2016-07-25 21:49:20 -07:00
6lowpan.h	6lowpan: add 802.15.4 short addr slaac	2016-06-15 20:41:22 -07:00
Space.h	…
act_api.h	net_sched: convert tcf_exts from list to pointer array	2016-08-17 19:27:51 -04:00
addrconf.h	ipv6: export several functions	2016-06-15 20:41:23 -07:00
af_ieee802154.h	…
af_rxrpc.h	rxrpc: Fix races between skb free, ACK generation and replying	2016-08-06 00:08:40 -04:00
af_unix.h	…
af_vsock.h	VSOCK: Introduce virtio_vsock_common.ko	2016-08-02 02:57:29 +03:00
ah.h	…
arp.h	…
atmclip.h	…
ax25.h	…
ax88796.h	…
bond_3ad.h	…
bond_alb.h	…
bond_options.h	…
bonding.h	bonding: prevent out of bound accesses	2016-07-01 06:06:09 -04:00
busy_poll.h	…
calipso.h	calipso: Add a label cache.	2016-06-27 15:06:17 -04:00
cfg80211-wext.h	…
cfg80211.h	cfg80211: Add mesh peer AID setting API	2016-07-06 15:04:52 +02:00
cfg802154.h	ieee802154: add netns support	2016-07-08 12:20:57 +02:00
checksum.h	csum: Update csum_block_add to use rotate instead of byteswap	2016-03-13 15:01:00 -04:00
cipso_ipv4.h	…
cls_cgroup.h	cls_cgroup: get sk_classid only from full sockets	2016-04-19 20:09:25 -04:00
codel.h	codel: split into multiple files	2016-04-25 16:44:27 -04:00
codel_impl.h	codel: split into multiple files	2016-04-25 16:44:27 -04:00
codel_qdisc.h	net_sched: fq_codel: cache skb->truesize into skb->cb	2016-06-25 12:19:35 -04:00
compat.h	packet: compat support for sock_fprog	2016-06-09 23:41:03 -07:00
datalink.h	…
dcbevent.h	…
dcbnl.h	…
devlink.h	net/devlink: Add E-Switch mode control	2016-07-02 14:40:40 -04:00
dn.h	…
dn_dev.h	…
dn_fib.h	…
dn_neigh.h	…
dn_nsp.h	…
dn_route.h	…
dsa.h	net: dsa: support switchdev ageing time attr	2016-07-19 19:42:01 -07:00
dsfield.h	…
dst.h	route: move lwtunnel state to a single place	2016-04-25 16:20:09 -04:00
dst_cache.h	…
dst_metadata.h	ip_tunnel: add support for setting flow label via collect metadata	2016-03-11 15:14:26 -05:00
dst_ops.h	…
esp.h	…
ethoc.h	…
fib_rules.h	net: Add l3mdev rule	2016-06-08 11:36:02 -07:00
firewire.h	…
flow.h	ipv6, trace: fix tos reporting on fib6_table_lookup	2016-03-20 13:44:34 -04:00
flow_dissector.h	net/flow_dissector: Make dissector_uses_key() and skb_flow_dissector_target() public	2016-03-10 16:24:02 -05:00
flowcache.h	…
fou.h	fou: Add encap ops for IPv6 tunnels	2016-05-20 18:03:16 -04:00
fq.h	fq: add fair queuing framework	2016-04-25 16:45:53 -04:00
fq_impl.h	fq: split out backlog update logic	2016-04-28 17:03:38 -04:00
garp.h	…
gen_stats.h	net: sched: do not acquire qdisc spinlock in qdisc/class stats dump	2016-06-07 16:37:14 -07:00
genetlink.h	…
geneve.h	net: Remove deprecated tunnel specific UDP offload functions	2016-06-17 20:23:32 -07:00
gre.h	gre: set inner_protocol on xmit	2016-08-15 13:37:12 -07:00
gro_cells.h	gro_cells: gro_cells_receive now return error code	2016-07-22 00:50:41 -04:00
gtp.h	gtp: #define #define _GTP_H_ and not #define _GTP_H	2016-07-25 17:55:43 -07:00
gue.h	…
hwbm.h	net: add a hardware buffer management helper API	2016-03-14 12:19:46 -04:00
icmp.h	net: snmp: kill STATS_BH macros	2016-04-27 22:48:25 -04:00
ieee80211_radiotap.h	…
ieee802154_netdev.h	…
if_inet6.h	…
ila.h	…
inet6_connection_sock.h	ipv6: remove unused in6_addr struct	2016-03-22 15:45:44 -04:00
inet6_hashtables.h	tcp/dccp: do not touch listener sk_refcnt under synflood	2016-04-04 22:11:20 -04:00
inet_common.h	ip4ip6: Support for GSO/GRO	2016-05-20 18:03:17 -04:00
inet_connection_sock.h	…
inet_ecn.h	ipv6: suppress sparse warnings in IP6_ECN_set_ce()	2016-08-13 15:08:00 -07:00
inet_frag.h	…
inet_hashtables.h	tcp/dccp: do not touch listener sk_refcnt under synflood	2016-04-04 22:11:20 -04:00
inet_sock.h	ipv6: Allow request socks to contain IPv6 options.	2016-06-27 15:05:28 -04:00
inet_timewait_sock.h	…
inetpeer.h	…
ip.h	net/ipv4: Introduce IPSKB_FRAG_SEGS bit to inet_skb_parm.flags	2016-07-19 16:40:22 -07:00
ip6_checksum.h	ipv6: Pass proto to csum_ipv6_magic as __u8 instead of unsigned short	2016-03-13 23:55:13 -04:00
ip6_fib.h	…
ip6_route.h	net: ipv6: Move ip6_route_get_saddr to inline	2016-06-17 21:25:29 -07:00
ip6_tunnel.h	ipv6: hide ip6_encap_hlen/ip6_tnl_encap definitions	2016-05-29 22:24:21 -07:00
ip_fib.h	…
ip_tunnels.h	gre: better support for ICMP messages for gre+ipv6	2016-06-18 22:11:39 -07:00
ip_vs.h	ipvs: update real-server binding of outgoing connections in SIP-pe	2016-06-06 09:47:25 +09:00
ipcomp.h	…
ipconfig.h	…
ipv6.h	Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/selinux into next	2016-07-07 10:15:34 +10:00
ipx.h	…
iw_handler.h	…
kcm.h	kcm: mark helper functions inline	2016-03-10 14:42:03 -05:00
l3mdev.h	net: ipv6: Address selection needs to consider L3 domains	2016-06-17 21:25:29 -07:00
lapb.h	…
lib80211.h	…
llc.h	…
llc_c_ac.h	…
llc_c_ev.h	…
llc_c_st.h	…
llc_conn.h	…
llc_if.h	…
llc_pdu.h	…
llc_s_ac.h	…
llc_s_ev.h	…
llc_s_st.h	…
llc_sap.h	…
lwtunnel.h	…
mac80211.h	mac80211: Add ieee80211_hw pointer to get_expected_throughput	2016-08-05 14:23:25 +02:00
mac802154.h	ieee802154: cleanup WARN_ON for fc fetch	2016-07-08 13:23:12 +02:00
mip6.h	…
mld.h	…
mpls.h	…
mpls_iptunnel.h	…
mrp.h	…
ncsi.h	net/ncsi: Package and channel management	2016-07-19 20:49:17 -07:00
ndisc.h	6lowpan: introduce 6lowpan-nd	2016-06-15 20:41:23 -07:00
neighbour.h	…
net_namespace.h	treewide: replace obsolete _refok by __ref	2016-08-02 17:31:41 -04:00
net_ratelimit.h	…
netevent.h	neigh: Send a notification when DELAY_PROBE_TIME changes	2016-07-05 09:06:29 -07:00
netlabel.h	netlabel: Implement CALIPSO config functions for SMACK.	2016-06-27 15:06:18 -04:00
netlink.h	netlink: kill nla_put_u64()	2016-05-16 13:46:23 -04:00
netprio_cgroup.h	…
netrom.h	…
nexthop.h	…
nl802154.h	ieee802154: add netns support	2016-07-08 12:20:57 +02:00
p8022.h	…
ping.h	net: ping: make ping_v6_sendmsg static	2016-03-23 22:09:58 -04:00
pkt_cls.h	net_sched: convert tcf_exts from list to pointer array	2016-08-17 19:27:51 -04:00
pkt_sched.h	net_sched: remove generic throttled management	2016-06-10 23:58:21 -07:00
protocol.h	udp: Remove udp_offloads	2016-04-07 16:53:30 -04:00
psnap.h	…
raw.h	…
rawv6.h	…
red.h	…
regulatory.h	…
request_sock.h	inet: reqsk_alloc() needs to take care of dead listeners	2016-04-04 22:11:19 -04:00
rose.h	…
route.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-04-23 18:51:33 -04:00
rtnetlink.h	net: rtnetlink: add support for the IFLA_STATS_LINK_XSTATS_SLAVE attribute	2016-06-30 06:15:04 -04:00
sch_generic.h	net_sched: generalize bulk dequeue	2016-06-25 12:19:35 -04:00
scm.h	…
secure_seq.h	…
slhc_vj.h	…
snmp.h	net: snmp: fix 64bit stats on 32bit arches	2016-04-28 11:49:45 -04:00
sock.h	dccp: limit sk_filter trim to payload	2016-07-13 11:53:41 -07:00
sock_reuseport.h	…
stp.h	…
switchdev.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-07-24 00:53:32 -04:00
tcp.h	tcp: fix use after free in tcp_xmit_retransmit_queue()	2016-08-18 23:22:57 -07:00
tcp_states.h	…
timewait_sock.h	…
transp_v6.h	ipv6: add new struct ipcm6_cookie	2016-05-03 16:08:14 -04:00
tso.h	…
udp.h	udp: avoid csum_partial() for validated skb	2016-06-01 17:41:36 -07:00
udp_tunnel.h	vxlan: Add new UDP encapsulation offload type for VXLAN-GPE	2016-06-17 20:23:32 -07:00
udplite.h	…
vsock_addr.h	…
vxlan.h	net: Remove deprecated tunnel specific UDP offload functions	2016-06-17 20:23:32 -07:00
wext.h	…
wimax.h	…
x25.h	…
x25device.h	…
xfrm.h	net: xfrm: kill XFRM_INC_STATS_BH()	2016-04-27 22:48:23 -04:00