diff options
| author |   Eric Dumazet <edumazet@google.com> | 2017-10-18 14:20:30 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2017-10-21 01:44:05 +0100 |
| commit | ba233b34741a1dc88d1e94db7deeb7b079ef4b9a (patch) | |
| tree | e1ead62e71ec931b1abeb1740a5dd649b490665d /net/tipc | |
| parent | Merge branch 'ipv6-fixes-for-RTF_CACHE-entries' (diff) | |
| download | wireguard-linux-ba233b34741a1dc88d1e94db7deeb7b079ef4b9a.tar.xz wireguard-linux-ba233b34741a1dc88d1e94db7deeb7b079ef4b9a.zip | |
tcp: fix tcp_send_syn_data()
syn_data was allocated by sk_stream_alloc_skb(), meaning
its destructor and _skb_refdst fields are mangled.
We need to call tcp_skb_tsorted_anchor_cleanup() before
calling kfree_skb() or kernel crashes.
Bug was reported by syzkaller bot.
Fixes: e2080072ed2d ("tcp: new list for sent but unacked skbs for RACK recovery")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc')
0 files changed, 0 insertions, 0 deletions