netfilter: nf_queue: don't assume sk is full socket
stable inclusion from linux-4.19.233 commit 6d9719ef61a99d1ed750b510d32620a6c4bb7397 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5646A CVE: NA -------------------------------- commit 747670fd9a2d1b7774030dba65ca022ba442ce71 upstream. There is no guarantee that state->sk refers to a full socket. If refcount transitions to 0, sock_put calls sk_free which then ends up with garbage fields. I'd like to thank Oleksandr Natalenko and Jiri Benc for considerable debug work and pointing out state->sk oddities. Fixes: ca6fb065 ("tcp: attach SYNACK messages to request sockets instead of listener") Tested-by:Oleksandr Natalenko <oleksandr@redhat.com> Signed-off-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Yongqiang Liu <liuyongqiang13@huawei.com>
Please register or sign in to comment