| Message ID | 1516956041-19067-1-git-send-email-lirongqing@baidu.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | tcp: release sk_frag.page in tcp_disconnect | expand |
From: Li RongQing <lirongqing@baidu.com> Date: Fri, 26 Jan 2018 16:40:41 +0800 > socket can be disconnected and gets transformed back to a listening > socket, if sk_frag.page is not released, which will be cloned into > a new socket by sk_clone_lock, but the reference count of this page > is increased, lead to a use after free or double free issue > > Signed-off-by: Li RongQing <lirongqing@baidu.com> > Cc: Eric Dumazet <edumazet@google.com> Applied and queued up for -stable, thank you.
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index f08eebe60446..73f068406519 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2431,6 +2431,12 @@ int tcp_disconnect(struct sock *sk, int flags) WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); + if (sk->sk_frag.page) { + put_page(sk->sk_frag.page); + sk->sk_frag.page = NULL; + sk->sk_frag.offset = 0; + } + sk->sk_error_report(sk); return err; }
socket can be disconnected and gets transformed back to a listening socket, if sk_frag.page is not released, which will be cloned into a new socket by sk_clone_lock, but the reference count of this page is increased, lead to a use after free or double free issue Signed-off-by: Li RongQing <lirongqing@baidu.com> Cc: Eric Dumazet <edumazet@google.com> --- net/ipv4/tcp.c | 6 ++++++ 1 file changed, 6 insertions(+)