]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
net: mctp: unshare packets when reassembling
authorMatt Johnston <matt@codeconstruct.com.au>
Thu, 6 Mar 2025 02:32:45 +0000 (10:32 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 22 Mar 2025 19:54:13 +0000 (12:54 -0700)
commit5c47d5bfa7b096cf8890afac32141c578583f8e0
tree9bf32c0be57cafdc3dbaf5cd2b58b8c498b24c3d
parenta597d4b75669ec82c72cbee9fe75a15d04b35b2b
net: mctp: unshare packets when reassembling

[ Upstream commit f5d83cf0eeb90fade4d5c4d17d24b8bee9ceeecc ]

Ensure that the frag_list used for reassembly isn't shared with other
packets. This avoids incorrect reassembly when packets are cloned, and
prevents a memory leak due to circular references between fragments and
their skb_shared_info.

The upcoming MCTP-over-USB driver uses skb_clone which can trigger the
problem - other MCTP drivers don't share SKBs.

A kunit test is added to reproduce the issue.

Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Fixes: 4a992bbd3650 ("mctp: Implement message fragmentation & reassembly")
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250306-matt-mctp-usb-v1-1-085502b3dd28@codeconstruct.com.au
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/mctp/route.c
net/mctp/test/route-test.c