diff options
| author |   Eric Dumazet <edumazet@google.com> | 2026-05-05 15:39:27 +0000 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2026-05-06 18:11:33 -0700 |
| commit | c8f7244c8cccaaed4e6c9fe4b8a07e101d0423e5 (patch) | |
| tree | 410de56141b25893ef9a03f0c23982d512c9eabd /tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com | |
| parent | net/sched: sch_sfq: annotate data-races from sfq_dump_class_stats() (diff) | |
tcp: tcp_child_process() related UAF
tcp_child_process( .. child ...) currently calls sock_put(child).
Unfortunately @child (named @nsk in callers) can be used after
this point to send a RST packet.
To fix this UAF, I remove the sock_put() from tcp_child_process()
and let the callers handle this after it is safe.
Remove @rsk variable in tcp_v4_do_rcv() and change tcp_v6_do_rcv()
so that both functions look the same.
Fixes: cfb6eeb4c860 ("[TCP]: MD5 Signature Option (RFC2385) support.")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260505153927.3435532-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/testing/selftests/dm-verity/git:/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions