]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: bcf3b41) | patch
mptcp: hold mptcp socket before calling tcp_done
authorFlorian Westphal <fw@strlen.de>
Thu, 10 Dec 2020 22:25:02 +0000 (14:25 -0800)
committerJakub Kicinski <kuba@kernel.org>
Tue, 15 Dec 2020 01:30:06 +0000 (17:30 -0800)
commit2eac564faa362aafaa590151d5bf7a0d8112c509
tree5559cd85ee60dc779980c70a28e3f7aea64c6caftree | snapshot
parentbcf3b417d8a5e3e6f5b89eda0a314772ec2e25a5commit | diff
mptcp: hold mptcp socket before calling tcp_done

When processing options from tcp reset path its possible that
tcp_done(ssk) drops the last reference on the mptcp socket which
results in use-after-free.

Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/mptcp/subflow.c diff | blob | history
Linux Kernel Source Tree.