From patchwork Wed Dec 5 02:54:18 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Weiping Pan X-Patchwork-Id: 203774 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id D96862C00AA for ; Wed, 5 Dec 2012 13:54:37 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752908Ab2LECyd (ORCPT ); Tue, 4 Dec 2012 21:54:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51877 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752818Ab2LECy3 (ORCPT ); Tue, 4 Dec 2012 21:54:29 -0500 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id qB52sTJ4015416 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 4 Dec 2012 21:54:29 -0500 Received: from localhost.localdomain.com ([10.66.17.46]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id qB52sJ9e032363; Tue, 4 Dec 2012 21:54:27 -0500 From: Weiping Pan To: netdev@vger.kernel.org Cc: brutus@google.com, Weiping Pan Subject: [PATCH 2/3] fix panic in tcp_close() Date: Wed, 5 Dec 2012 10:54:18 +0800 Message-Id: <1bce4074c1b2db217fa206c122902cef54e22280.1354674154.git.wpan@redhat.com> In-Reply-To: References: In-Reply-To: References: X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org For tcp friends data skb, it has no tcp header, and its transport_header is NULL, so it will panic if we deference tcp_hdr(skb) in tcp_close(). So I add a check before we use tcp_hdr(). Signed-off-by: Weiping Pan --- net/ipv4/tcp.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 4327deb..e9d82e0 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2512,8 +2512,12 @@ void tcp_close(struct sock *sk, long timeout) * reader process may not have drained the data yet! */ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { - u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq - + u32 len; + if (tcp_hdr(skb)) + len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq - tcp_hdr(skb)->fin; + else + len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; data_was_unread += len; __kfree_skb(skb); }