tcp: fix possible NULL dereference in tcp_vX_send_reset() (c3658e8d) · Commits · 戴 / test

After commit ("tcp: remove dst refcount false sharing for prequeue mode") we have to relax check against skb dst in tcp_v[46]_send_reset() if prequeue dropped the dst. If a socket is provided, a full lookup was done to find this socket, so the dst test can be skipped. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88191 Reported-by:

Jaša Bartelj <jasa.bartelj@gmail.com> Signed-off-by:

Eric Dumazet <edumazet@google.com> Reported-by:

Daniel Borkmann <dborkman@redhat.com> Fixes: ("tcp: remove dst refcount false sharing for prequeue mode") Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/tcp_ipv4.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -598,7 +598,10 @@ static void tcp_v4_send_reset(struct sock sk, struct sk_buff skb)
		if (th->rst)
		return;

		if (skb_rtable(skb)->rt_type != RTN_LOCAL)
		/* If sk not NULL, it means we did a successful lookup and incoming
		* route had to be correct. prequeue might have dropped our dst.
		*/
		if (!sk && skb_rtable(skb)->rt_type != RTN_LOCAL)
		return;

		/* Swap the send and the receive. */

net/ipv6/tcp_ipv6.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -903,7 +903,10 @@ static void tcp_v6_send_reset(struct sock sk, struct sk_buff skb)
		if (th->rst)
		return;

		if (!ipv6_unicast_destination(skb))
		/* If sk not NULL, it means we did a successful lookup and incoming
		* route had to be correct. prequeue might have dropped our dst.
		*/
		if (!sk && !ipv6_unicast_destination(skb))
		return;

		#ifdef CONFIG_TCP_MD5SIG

Admin message