Commit ba233b34 authored Oct 18, 2017 by Eric Dumazet Committed by David S. Miller Oct 21, 2017

tcp: fix tcp_send_syn_data()



syn_data was allocated by sk_stream_alloc_skb(), meaning
its destructor and _skb_refdst fields are mangled.

We need to call tcp_skb_tsorted_anchor_cleanup() before
calling kfree_skb() or kernel crashes.

Bug was reported by syzkaller bot.

Fixes: e2080072 ("tcp: new list for sent but unacked skbs for RACK recovery")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 27188af5

net/ipv4/tcp_output.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -3383,6 +3383,7 @@ static int tcp_send_syn_data(struct sock sk, struct sk_buff syn)
		int copied = copy_from_iter(skb_put(syn_data, space), space,
		&fo->data->msg_iter);
		if (unlikely(!copied)) {
		tcp_skb_tsorted_anchor_cleanup(syn_data);
		kfree_skb(syn_data);
		goto fallback;
		}

Admin message