diff options
| author |   Kuniyuki Iwashima <kuniyu@google.com> | 2026-05-06 03:59:19 +0000 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2026-05-08 14:54:51 -0700 |
| commit | 7eca3292cac7c26dad4c236f51ba225c39a0523f (patch) | |
| tree | a81fbd2b5b67b7d7d919d42f1701e75ca7c49e7c /include/linux/clk/ssh:/git@git.zx2c4.com | |
| parent | tcp: Fix potential UAF in reqsk_timer_handler(). (diff) | |
tcp: Fix imbalanced icsk_accept_queue count.
When TCP socket migration happens in reqsk_timer_handler(),
@sk_listener will be updated with the new listener.
When we call __inet_csk_reqsk_queue_drop(), the listener must
be the one stored in req->rsk_listener.
The cited commit accidentally replaced oreq->rsk_listener with
sk_listener, leading to imbalanced icsk_accept_queue count.
Let's pass the correct listener to __inet_csk_reqsk_queue_drop().
Fixes: e8c526f2bdf1 ("tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260506035954.1563147-3-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/linux/clk/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions