diff options
| author | Eric Dumazet <[email protected]> | 2017-10-18 21:20:30 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2017-10-21 00:44:05 +0000 |
| commit | ba233b34741a1dc88d1e94db7deeb7b079ef4b9a (patch) | |
| tree | e1ead62e71ec931b1abeb1740a5dd649b490665d /net/unix/af_unix.c | |
| parent | Merge branch 'ipv6-fixes-for-RTF_CACHE-entries' (diff) | |
| download | kernel-ba233b34741a1dc88d1e94db7deeb7b079ef4b9a.tar.gz kernel-ba233b34741a1dc88d1e94db7deeb7b079ef4b9a.zip | |
tcp: fix tcp_send_syn_data()
syn_data was allocated by sk_stream_alloc_skb(), meaning
its destructor and _skb_refdst fields are mangled.
We need to call tcp_skb_tsorted_anchor_cleanup() before
calling kfree_skb() or kernel crashes.
Bug was reported by syzkaller bot.
Fixes: e2080072ed2d ("tcp: new list for sent but unacked skbs for RACK recovery")
Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: Dmitry Vyukov <[email protected]>
Acked-by: Yuchung Cheng <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions