Commit 9ae27e0a authored by Evgeniy Polyakov's avatar Evgeniy Polyakov Committed by David S. Miller

tcp: Fix slab corruption with ipv6 and tcp6fuzz

From: Evgeniy Polyakov <johnpol@2ka.mipt.ru>

This fixes a regression added by ec3c0982
("[TCP]: TCP_DEFER_ACCEPT updates - process as established")

tcp_v6_do_rcv()->tcp_rcv_established(), the latter goes to step5, where
eventually skb can be freed via tcp_data_queue() (drop: label), then if
check for tcp_defer_accept_check() returns true and thus
tcp_rcv_established() returns -1, which forces tcp_v6_do_rcv() to jump
to reset: label, which in turn will pass through discard: label and free
the same skb again.

Tested by Eric Sesterhenn.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Acked-By: default avatarPatrick McManus <mcmanus@ducksong.com>
parent dae50295
...@@ -4925,8 +4925,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb, ...@@ -4925,8 +4925,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
tcp_data_snd_check(sk); tcp_data_snd_check(sk);
tcp_ack_snd_check(sk); tcp_ack_snd_check(sk);
if (tcp_defer_accept_check(sk)) tcp_defer_accept_check(sk);
return -1;
return 0; return 0;
csum_error: csum_error:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment