diff options
| author |   Eric Dumazet <edumazet@google.com> | 2014-11-25 07:40:04 -0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2014-11-25 14:29:18 -0500 |
| commit | c3658e8d0f10147fc86018be7f11668246c156d3 (patch) | |
| tree | a25e9383d5b91d6062aa4770e6a181e9079d0396 /net/ipv4/tcp_ipv4.c | |
| parent | Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse" (diff) | |
| download | linux-dev-c3658e8d0f10147fc86018be7f11668246c156d3.tar.xz linux-dev-c3658e8d0f10147fc86018be7f11668246c156d3.zip | |
tcp: fix possible NULL dereference in tcp_vX_send_reset()
After commit ca777eff51f7 ("tcp: remove dst refcount false sharing for
prequeue mode") we have to relax check against skb dst in
tcp_v[46]_send_reset() if prequeue dropped the dst.
If a socket is provided, a full lookup was done to find this socket,
so the dst test can be skipped.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88191
Reported-by: Jaša Bartelj <jasa.bartelj@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Daniel Borkmann <dborkman@redhat.com>
Fixes: ca777eff51f7 ("tcp: remove dst refcount false sharing for prequeue mode")
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_ipv4.c')
| -rw-r--r-- | net/ipv4/tcp_ipv4.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 9c7d7621466b..147be2024290 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -598,7 +598,10 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb) if (th->rst) return; - if (skb_rtable(skb)->rt_type != RTN_LOCAL) + /* If sk not NULL, it means we did a successful lookup and incoming + * route had to be correct. prequeue might have dropped our dst. + */ + if (!sk && skb_rtable(skb)->rt_type != RTN_LOCAL) return; /* Swap the send and the receive. */ |