CVE-2022-49142

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: preserve skb_end_offset() in skb_unclone_keeptruesize()

syzbot found another way to trigger the infamous WARN_ON_ONCE(delta < len)

in skb_try_coalesce() [1]

I was able to root cause the issue to kfence.

When kfence is in action, the following assertion is no longer true:

int size = xxxx;

void *ptr1 = kmalloc(size, gfp);

void *ptr2 = kmalloc(size, gfp);

if (ptr1 && ptr2)

ASSERT(ksize(ptr1) == ksize(ptr2));

We attempted to fix these issues in the blamed commits, but forgot

that TCP was possibly shifting data after skb_unclone_keeptruesize()

has been used, notably from tcp_retrans_try_collapse().

So we not only need to keep same skb->truesize value,

we also need to make sure TCP wont fill new tailroom

that pskb_expand_head() was able to get from a

addr = kmalloc(...) followed by ksize(addr)

Split skb_unclone_keeptruesize() into two parts:

1) Inline skb_unclone_keeptruesize() for the common case,

when sk

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References