[SRU][J][PATCH 1/1] net: mctp: unshare packets when reassembling

[Cengiz Can]

From: Matt Johnston <matt at codeconstruct.com.au>

Ensure that the frag_list used for reassembly isn't shared with other
packets. This avoids incorrect reassembly when packets are cloned, and
prevents a memory leak due to circular references between fragments and
their skb_shared_info.

The upcoming MCTP-over-USB driver uses skb_clone which can trigger the
problem - other MCTP drivers don't share SKBs.

A kunit test is added to reproduce the issue.

Signed-off-by: Matt Johnston <matt at codeconstruct.com.au>
Fixes: 4a992bbd3650 ("mctp: Implement message fragmentation & reassembly")
Reviewed-by: Simon Horman <horms at kernel.org>
Link: https://patch.msgid.link/20250306-matt-mctp-usb-v1-1-085502b3dd28@codeconstruct.com.au
Signed-off-by: Paolo Abeni <pabeni at redhat.com>
(backported from commit f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc)
[bot_kybele: Dropped the route-test.c kunit hunk: this tree has no net/mctp/test
 framework (absent from HEAD/Makefile, no CONFIG_MCTP_TEST, and the test uses
 skb_recv_datagram/KUNIT_EXPECT_MEMEQ APIs not present here); applied only the
 route.c skb_unshare reassembly fix.]
CVE-2025-21972
Assisted-by: kybele:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can at canonical.com>
---
 net/mctp/route.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/mctp/route.c b/net/mctp/route.c
index 0eb2c04fef78..29ef22f55222 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -192,8 +192,14 @@ static int mctp_frag_queue(struct mctp_sk_key *key, struct sk_buff *skb)
 		& MCTP_HDR_SEQ_MASK;
 
 	if (!key->reasm_head) {
-		key->reasm_head = skb;
-		key->reasm_tailp = &(skb_shinfo(skb)->frag_list);
+		/* Since we're manipulating the shared frag_list, ensure it isn't
+		 * shared with any other SKBs.
+		 */
+		key->reasm_head = skb_unshare(skb, GFP_ATOMIC);
+		if (!key->reasm_head)
+			return -ENOMEM;
+
+		key->reasm_tailp = &(skb_shinfo(key->reasm_head)->frag_list);
 		key->last_seq = this_seq;
 		return 0;
 	}
-- 
2.53.0