linux-kernel - Re: [syzbot] KASAN: use-after-free Read in tipc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210723195253.56ef4ee3@gmail.com>
Date:   Fri, 23 Jul 2021 19:52:53 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     Xin Long <lucien.xin@...il.com>
Cc:     syzbot <syzbot+e6741b97d5552f97c24d@...kaller.appspotmail.com>,
        davem <davem@...emloft.net>, devicetree@...r.kernel.org,
        frowand.list@...il.com,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jon Maloy <jmaloy@...hat.com>,
        Jakub Kicinski <kuba@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        network dev <netdev@...r.kernel.org>, rafael@...nel.org,
        robh+dt@...nel.org, robh@...nel.org,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>,
        tipc-discussion@...ts.sourceforge.net,
        Ying Xue <ying.xue@...driver.com>
Subject: Re: [syzbot] KASAN: use-after-free Read in tipc_recvmsg

On Fri, 23 Jul 2021 12:41:46 -0400
Xin Long <lucien.xin@...il.com> wrote:

> a fix already posted in tipc-discussion:
> 
> diff --git a/net/tipc/socket.c b/net/tipc/socket.c
> index 9b0b311c7ec1..b0dd183a4dbc 100644
> --- a/net/tipc/socket.c
> +++ b/net/tipc/socket.c
> @@ -1973,10 +1973,12 @@ static int tipc_recvmsg(struct socket *sock,
> struct msghdr *m,
>                 tipc_node_distr_xmit(sock_net(sk), &xmitq);
>         }
> 
> -       if (!skb_cb->bytes_read)
> -               tsk_advance_rx_queue(sk);
> +       if (skb_cb->bytes_read)
> +               goto exit;
> +
> +       tsk_advance_rx_queue(sk);
> 
> -       if (likely(!connected) || skb_cb->bytes_read)
> +       if (likely(!connected))
>                 goto exit;
> 

Ok, thank you for informing


With regards,
Pavel Skripkin