]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
authorFlorian Westphal <fw@strlen.de>
Tue, 17 Jul 2018 19:03:15 +0000 (21:03 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 20 Jul 2018 13:31:44 +0000 (15:31 +0200)
commit904e072856388790706c04aa9ff2c068e8c45465
treec9a2de23089be23f4ae25930b67781c45823156b
parent94767701cb76e815d0c8cf6530083c016b68b351
netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state

When first DCCP packet is SYNC or SYNCACK, we insert a new conntrack
that has an un-initialized timeout value, i.e. such entry could be
reaped at any time.

Mark them as INVALID and only ignore SYNC/SYNCACK when connection had
an old state.

Reported-by: syzbot+6f18401420df260e37ed@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conntrack_proto_dccp.c