Re: [tipc-discussion] [PATCH net] tipc: use skb_unshare() instead in tipc_buf_append()

2020-09-14 Thread David Miller
From: Xin Long Date: Sun, 13 Sep 2020 19:37:31 +0800 > In tipc_buf_append() it may change skb's frag_list, and it causes > problems when this skb is cloned. skb_unclone() doesn't really > make this skb's flag_list available to change. > > Shuang Li has reported an use-after-free issue because

[tipc-discussion] [PATCH net] tipc: use skb_unshare() instead in tipc_buf_append()

2020-09-13 Thread Xin Long
In tipc_buf_append() it may change skb's frag_list, and it causes problems when this skb is cloned. skb_unclone() doesn't really make this skb's flag_list available to change. Shuang Li has reported an use-after-free issue because of this when creating quite a few macvlan dev over the same dev,