bianbu-repo-mirror/bianbu-linux-6.6
1
0
Fork 0
mirror of https://gitee.com/bianbu-linux/linux-6.6 synced 2025-04-24 14:07:52 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

net: tcp: reset 'drop_reason' to NOT_SPCIFIED in tcp_v{4,6}_rcv()

Browse source 
The 'drop_reason' that passed to kfree_skb_reason() in tcp_v4_rcv()
and tcp_v6_rcv() can be SKB_NOT_DROPPED_YET(0), as it is used as the
return value of tcp_inbound_md5_hash().

And it can panic the kernel with NULL pointer in
net_dm_packet_report_size() if the reason is 0, as drop_reasons[0]
is NULL.

Fixes: 1330b6ef33 ("skb: make drop reason booleanable")
Reviewed-by: Jiang Biao <benbjiang@tencent.com>
Reviewed-by: Hao Peng <flyingpeng@tencent.com>
Signed-off-by: Menglong Dong <imagedong@tencent.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Menglong Dong 2022-05-13 11:03:39 +08:00 • committed by David S. Miller
parent 7ebd3f3ee5
commit f8319dfd1b
2 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
net/ipv4/tcp_ipv4.c
View file

@ -2101,6 +2101,7 @@ bad_packet:
} }
discard_it: discard_it:
SKB_DR_OR(drop_reason, NOT_SPECIFIED);
/* Discard frame. */ /* Discard frame. */
kfree_skb_reason(skb, drop_reason); kfree_skb_reason(skb, drop_reason);
return 0; return 0;

1
net/ipv6/tcp_ipv6.c
View file

@ -1509,6 +1509,7 @@ reset:
discard: discard:
if (opt_skb) if (opt_skb)
__kfree_skb(opt_skb); __kfree_skb(opt_skb);
SKB_DR_OR(reason, NOT_SPECIFIED);
kfree_skb_reason(skb, reason); kfree_skb_reason(skb, reason);
return 0; return 0;
csum_err: csum_err: