• Eric Dumazet's avatar
    tcp: clear saved_syn in tcp_disconnect() · 29dc163a
    Eric Dumazet authored
    [ Upstream commit 17c3060b ]
    
    In the (very unlikely) case a passive socket becomes a listener,
    we do not want to duplicate its saved SYN headers.
    
    This would lead to double frees, use after free, and please hackers and
    various fuzzers
    
    Tested:
        0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
       +0 setsockopt(3, IPPROTO_TCP, TCP_SAVE_SYN, [1], 4) = 0
       +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
    
       +0 bind(3, ..., ...) = 0
       +0 listen(3, 5) = 0
    
       +0 < S 0:0(0) win 32972 <mss 1460,nop,wscale 7>
       +0 > S. 0:0(0) ack 1 <...>
      +.1 < . 1:1(0) ack 1 win 257
       +0 accept(3, ..., ...) = 4
    
       +0 connect(4, AF_UNSPEC, ...) = 0
       +0 close(3) = 0
       +0 bind(4, ..., ...) = 0
       +0 listen(4, 5) = 0
    
       +0 < S 0:0(0) win 32972 <mss 1460,nop,wscale 7>
       +0 > S. 0:0(0) ack 1 <...>
      +.1 < . 1:1(0) ack 1 win 257
    
    Fixes: cd8ae852 ("tcp: provide SYN headers for passive connections")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    29dc163a
tcp.c 87.6 KB