Message ID | 1494336559.7796.78.camel@edumazet-glaptop3.roam.corp.google.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Eric Dumazet <eric.dumazet@gmail.com> Date: Tue, 09 May 2017 06:29:19 -0700 > From: Eric Dumazet <edumazet@google.com> > > syzkaller found a way to trigger double frees from ip_mc_drop_socket() > > It turns out that leave a copy of parent mc_list at accept() time, > which is very bad. > > Very similar to commit 8b485ce69876 ("tcp: do not inherit > fastopen_req from parent") > > Initial report from Pray3r, completed by Andrey one. > Thanks a lot to them ! > > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: Pray3r <pray3r.z@gmail.com> > Reported-by: Andrey Konovalov <andreyknvl@google.com> > Tested-by: Andrey Konovalov <andreyknvl@google.com> > --- > v2: fix moved into inet_csk_clone_lock() to fix both DCCP and TCP Applied and queued up for -stable, thanks Eric.
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index 5e313c1ac94fc88eca5fe3a0e9e46e551e955ff0..1054d330bf9df3189a21dbb08e27c0e6ad136775 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -794,6 +794,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk, /* listeners have SOCK_RCU_FREE, not the children */ sock_reset_flag(newsk, SOCK_RCU_FREE); + inet_sk(newsk)->mc_list = NULL; + newsk->sk_mark = inet_rsk(req)->ir_mark; atomic64_set(&newsk->sk_cookie, atomic64_read(&inet_rsk(req)->ir_cookie));