Commit fb7e2399 authored by Masayuki Nakagawa's avatar Masayuki Nakagawa Committed by David S. Miller

[TCP]: skb is unexpectedly freed.

I encountered a kernel panic with my test program, which is a very
simple IPv6 client-server program.

The server side sets IPV6_RECVPKTINFO on a listening socket, and the
client side just sends a message to the server.  Then the kernel panic
occurs on the server.  (If you need the test program, please let me
know. I can provide it.)

This problem happens because a skb is forcibly freed in
tcp_rcv_state_process().

When a socket in listening state(TCP_LISTEN) receives a syn packet,
then tcp_v6_conn_request() will be called from
tcp_rcv_state_process().  If the tcp_v6_conn_request() successfully
returns, the skb would be discarded by __kfree_skb().

However, in case of a listening socket which was already set
IPV6_RECVPKTINFO, an address of the skb will be stored in
treq->pktopts and a ref count of the skb will be incremented in
tcp_v6_conn_request().  But, even if the skb is still in use, the skb
will be freed.  Then someone still using the freed skb will cause the
kernel panic.

I suggest to use kfree_skb() instead of __kfree_skb().
Signed-off-by: default avatarMasayuki Nakagawa <nakagawa.msy@ncos.nec.co.jp>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a6c7ab55
...@@ -4420,9 +4420,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, ...@@ -4420,9 +4420,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
* But, this leaves one open to an easy denial of * But, this leaves one open to an easy denial of
* service attack, and SYN cookies can't defend * service attack, and SYN cookies can't defend
* against this problem. So, we drop the data * against this problem. So, we drop the data
* in the interest of security over speed. * in the interest of security over speed unless
* it's still in use.
*/ */
goto discard; kfree_skb(skb);
return 0;
} }
goto discard; goto discard;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment