diff options
| author | Eric Dumazet <edumazet@google.com> | 2017-10-18 14:20:30 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-10-21 01:44:05 +0100 |
| commit | ba233b34741a1dc88d1e94db7deeb7b079ef4b9a (patch) | |
| tree | e1ead62e71ec931b1abeb1740a5dd649b490665d /net/ipv4/tcp_cong.c | |
| parent | 27188af5ab2f11dd6a4b548940db6464c8fcfe28 (diff) | |
| download | linux-ba233b34741a1dc88d1e94db7deeb7b079ef4b9a.tar.bz2 | |
tcp: fix tcp_send_syn_data()
syn_data was allocated by sk_stream_alloc_skb(), meaning
its destructor and _skb_refdst fields are mangled.
We need to call tcp_skb_tsorted_anchor_cleanup() before
calling kfree_skb() or kernel crashes.
Bug was reported by syzkaller bot.
Fixes: e2080072ed2d ("tcp: new list for sent but unacked skbs for RACK recovery")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_cong.c')
0 files changed, 0 insertions, 0 deletions