[CVE-2016-6828][xenial, vivid, trusty, precise] tcp: fix use after free in tcp_xmit_retransmit_queue()

Luis Henriques luis.henriques at canonical.com
Mon Sep 19 10:11:01 UTC 2016

From: Eric Dumazet <edumazet at google.com>

When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the
tail of the write queue using tcp_add_write_queue_tail()

Then it attempts to copy user data into this fresh skb.

If the copy fails, we undo the work and remove the fresh skb.

Unfortunately, this undo lacks the change done to tp->highest_sack and
we can leave a dangling pointer (to a freed skb)

Later, tcp_xmit_retransmit_queue() can dereference this pointer and
access freed memory. For regular kernels where memory is not unmapped,
this might cause SACK bugs because tcp_highest_sack_seq() is buggy,
returning garbage instead of tp->snd_nxt, but with various debug
features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.

This bug was found by Marco Grassi thanks to syzkaller.

Fixes: 6859d49475d4 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb")
Reported-by: Marco Grassi <marco.gra at gmail.com>
Signed-off-by: Eric Dumazet <edumazet at google.com>
Cc: Ilpo Järvinen <ilpo.jarvinen at helsinki.fi>
Cc: Yuchung Cheng <ycheng at google.com>
Cc: Neal Cardwell <ncardwell at google.com>
Acked-by: Neal Cardwell <ncardwell at google.com>
Reviewed-by: Cong Wang <xiyou.wangcong at gmail.com>
Signed-off-by: David S. Miller <davem at davemloft.net>

(cherry picked from commit bb1fceca22492109be12640d49f5ea5a544c6bb4)
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
 include/net/tcp.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 414d822bc1db..9c3ab544d3a8 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1510,6 +1510,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli
 	if (sk->sk_send_head == skb_unlinked)
 		sk->sk_send_head = NULL;
+	if (tcp_sk(sk)->highest_sack == skb_unlinked)
+		tcp_sk(sk)->highest_sack = NULL;
 static inline void tcp_init_send_head(struct sock *sk)

More information about the kernel-team mailing list