diff options
| author | Wei Wang <[email protected]> | 2017-03-01 21:29:48 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2017-03-02 22:05:41 +0000 |
| commit | 7db92362d2fee5887f6b0c41653b8c9f8f5d6020 (patch) | |
| tree | 4d1b45575d0b490061671c4dddaa32f795013e59 /scripts/gcc-plugins/gcc-generate-simple_ipa-pass.h | |
| parent | net: Introduce sk_clone_lock() error path routine (diff) | |
| download | kernel-7db92362d2fee5887f6b0c41653b8c9f8f5d6020.tar.gz kernel-7db92362d2fee5887f6b0c41653b8c9f8f5d6020.zip | |
tcp: fix potential double free issue for fastopen_req
tp->fastopen_req could potentially be double freed if a malicious
user does the following:
1. Enable TCP_FASTOPEN_CONNECT sockopt and do a connect() on the socket.
2. Call connect() with AF_UNSPEC to disconnect the socket.
3. Make this socket a listening socket by calling listen().
4. Accept incoming connections and generate child sockets. All child
sockets will get a copy of the pointer of fastopen_req.
5. Call close() on all sockets. fastopen_req will get freed multiple
times.
Fixes: 19f6d3f3c842 ("net/tcp-fastopen: Add new API support")
Reported-by: Andrey Konovalov <[email protected]>
Signed-off-by: Wei Wang <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'scripts/gcc-plugins/gcc-generate-simple_ipa-pass.h')
0 files changed, 0 insertions, 0 deletions