mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-11 04:18:39 +08:00
tcp: fix possible NULL dereference in tcp_vX_send_reset()
After commitca777eff51
("tcp: remove dst refcount false sharing for prequeue mode") we have to relax check against skb dst in tcp_v[46]_send_reset() if prequeue dropped the dst. If a socket is provided, a full lookup was done to find this socket, so the dst test can be skipped. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88191 Reported-by: Jaša Bartelj <jasa.bartelj@gmail.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Daniel Borkmann <dborkman@redhat.com> Fixes:ca777eff51
("tcp: remove dst refcount false sharing for prequeue mode") Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
43612d7c04
commit
c3658e8d0f
@ -598,7 +598,10 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
|
||||
if (th->rst)
|
||||
return;
|
||||
|
||||
if (skb_rtable(skb)->rt_type != RTN_LOCAL)
|
||||
/* If sk not NULL, it means we did a successful lookup and incoming
|
||||
* route had to be correct. prequeue might have dropped our dst.
|
||||
*/
|
||||
if (!sk && skb_rtable(skb)->rt_type != RTN_LOCAL)
|
||||
return;
|
||||
|
||||
/* Swap the send and the receive. */
|
||||
|
@ -903,7 +903,10 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
|
||||
if (th->rst)
|
||||
return;
|
||||
|
||||
if (!ipv6_unicast_destination(skb))
|
||||
/* If sk not NULL, it means we did a successful lookup and incoming
|
||||
* route had to be correct. prequeue might have dropped our dst.
|
||||
*/
|
||||
if (!sk && !ipv6_unicast_destination(skb))
|
||||
return;
|
||||
|
||||
#ifdef CONFIG_TCP_MD5SIG
|
||||
|
Loading…
Reference in New Issue
Block a user