-
Eric Dumazet authored
syzkaller found a way to trigger double frees from ip_mc_drop_socket() It turns out that leave a copy of parent mc_list at accept() time, which is very bad. Very similar to commit 8b485ce6 ("tcp: do not inherit fastopen_req from parent") Initial report from Pray3r, completed by Andrey one. Thanks a lot to them ! Signed-off-by:
Eric Dumazet <edumazet@google.com> Reported-by:
Pray3r <pray3r.z@gmail.com> Reported-by:
Andrey Konovalov <andreyknvl@google.com> Tested-by:
Andrey Konovalov <andreyknvl@google.com> Signed-off-by:
David S. Miller <davem@davemloft.net> CVE-2017-8890 (backported from 657831ff) [ignored top fuzz] Signed-off-by:
Stefan Bader <stefan.bader@canonical.com> Acked-by:
Colin Ian King <colin.king@canonical.com> Acked-by:
Andy Whitcroft <apw@canonical.com> Signed-off-by:
Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
5376db52