Skip to content
Snippets Groups Projects
Commit 7078f0dd authored by Florian Westphal's avatar Florian Westphal Committed by Yongqiang Liu
Browse files

netfilter: nf_queue: don't assume sk is full socket

stable inclusion
from linux-4.19.233
commit 6d9719ef61a99d1ed750b510d32620a6c4bb7397
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5646A


CVE: NA

--------------------------------

commit 747670fd9a2d1b7774030dba65ca022ba442ce71 upstream.

There is no guarantee that state->sk refers to a full socket.

If refcount transitions to 0, sock_put calls sk_free which then ends up
with garbage fields.

I'd like to thank Oleksandr Natalenko and Jiri Benc for considerable
debug work and pointing out state->sk oddities.

Fixes: ca6fb065 ("tcp: attach SYNACK messages to request sockets instead of listener")
Tested-by: default avatarOleksandr Natalenko <oleksandr@redhat.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent 48c4b4b5
No related branches found
No related tags found
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment