Browse files

tcp: fix use after free in tcp_xmit_retransmit_queue()

When tcp_sendmsg() allocates a fresh and empty skb, it puts it at the
tail of the write queue using tcp_add_write_queue_tail()

Then it attempts to copy user data into this fresh skb.

If the copy fails, we undo the work and remove the fresh skb.

Unfortunately, this undo lacks the change done to tp->highest_sack and
we can leave a dangling pointer (to a freed skb)

Later, tcp_xmit_retransmit_queue() can dereference this pointer and
access freed memory. For regular kernels where memory is not unmapped,
this might cause SACK bugs because tcp_highest_sack_seq() is buggy,
returning garbage instead of tp->snd_nxt, but with various debug
features like CONFIG_DEBUG_PAGEALLOC, this can crash the kernel.

This bug was found by Marco Grassi thanks to syzkaller.

Change-Id: I264f97d30d0a623011d9ee811c63fa0e0c2149a2
Fixes: 6859d49 ("[TCP]: Abstract tp->highest_sack accessing & point to next skb")
Reported-by: Marco Grassi <>
Signed-off-by: Eric Dumazet <>
Cc: Ilpo Järvinen <>
Cc: Yuchung Cheng <>
Cc: Neal Cardwell <>
Acked-by: Neal Cardwell <>
Reviewed-by: Cong Wang <>
Signed-off-by: David S. Miller <>
  • Loading branch information...
Eric Dumazet authored and andi34 committed Aug 17, 2016
1 parent f5d463d commit 168536a7dc1413e5971d6c9c3df579ac8d4cf282
Showing with 2 additions and 0 deletions.
  1. +2 −0 include/net/tcp.h
@@ -1251,6 +1251,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli
if (sk->sk_send_head == skb_unlinked)
sk->sk_send_head = NULL;
if (tcp_sk(sk)->highest_sack == skb_unlinked)
tcp_sk(sk)->highest_sack = NULL;
static inline void tcp_init_send_head(struct sock *sk)

0 comments on commit 168536a

Please sign in to comment.