linux/net at 17c3060b1701fc69daedb4c90be6325d3d9fca8e - linux - FoxGit

torvalds/linux

mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-04-12 09:20:50 +08:00

Files

History

Eric Dumazet 17c3060b17 tcp: clear saved_syn in tcp_disconnect()

In the (very unlikely) case a passive socket becomes a listener,
we do not want to duplicate its saved SYN headers.

This would lead to double frees, use after free, and please hackers and
various fuzzers

Tested:
    0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
   +0 setsockopt(3, IPPROTO_TCP, TCP_SAVE_SYN, [1], 4) = 0
   +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0

   +0 bind(3, ..., ...) = 0
   +0 listen(3, 5) = 0

   +0 < S 0:0(0) win 32972 <mss 1460,nop,wscale 7>
   +0 > S. 0:0(0) ack 1 <...>
  +.1 < . 1:1(0) ack 1 win 257
   +0 accept(3, ..., ...) = 4

   +0 connect(4, AF_UNSPEC, ...) = 0
   +0 close(3) = 0
   +0 bind(4, ..., ...) = 0
   +0 listen(4, 5) = 0

   +0 < S 0:0(0) win 32972 <mss 1460,nop,wscale 7>
   +0 > S. 0:0(0) ack 1 <...>
  +.1 < . 1:1(0) ack 1 win 257

Fixes: cd8ae85299 ("tcp: provide SYN headers for passive connections")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2017-04-09 18:27:28 -07:00

..

6lowpan: use rb_entry()

2017-01-22 16:46:13 -05:00

Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-03-03 21:44:35 -08:00

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

net: remove ndo_neigh_{construct, destroy} from stacked devices

2017-02-06 11:25:57 -05:00

lib/vsprintf.c: remove %Z support

2017-02-27 18:43:47 -08:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

Merge tag 'batadv-net-for-davem-20170316' of git://git.open-mesh.org/linux-merge

2017-03-16 12:05:38 -07:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

bridge: resolve a false alarm of lockdep

2017-03-16 21:29:20 -07:00

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>

2017-03-02 08:42:29 +01:00

can: bcm: fix hrtimer/tasklet termination in bcm op removal

2017-01-30 11:05:04 +01:00

libceph: force GFP_NOIO for socket allocations

2017-03-23 12:03:36 +01:00

Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2017-04-06 11:57:04 -07:00

net: dcb: set error code on failures

2016-12-03 23:54:25 -05:00

dccp: fix memory leak during tear-down of unsuccessful connection request

2017-03-13 22:00:42 -07:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

Merge branch 'WIP.sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2017-03-03 10:16:38 -08:00

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2017-02-11 02:31:11 -05:00

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

2017-02-16 21:25:49 -05:00

net/hsr: use eth_hw_addr_random()

2017-02-21 13:25:22 -05:00

lib/vsprintf.c: remove %Z support

2017-02-27 18:43:47 -08:00

net: Introduce ife encapsulation module

2017-02-03 15:16:45 -05:00

tcp: clear saved_syn in tcp_disconnect()

2017-04-09 18:27:28 -07:00

ipv6: make sure to initialize sockc.tsflags before first use

2017-03-22 12:40:22 -07:00

ktime: Get rid of the union

2016-12-25 17:21:22 +01:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

kcm: return immediately after copy_from_user() failure

2017-03-24 13:13:53 -07:00

netns: make struct pernet_operations::id unsigned int

2016-11-18 10:59:15 -05:00

l2tp: don't mask errors in pppol2tp_getsockopt()

2017-04-08 08:29:04 -07:00

net: ipv6: Remove l3mdev_get_saddr6

2016-09-10 23:12:53 -07:00

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

mac80211: unconditionally start new netdev queues with iTXQ support

2017-03-29 14:20:40 +02:00

sched/headers: Prepare to use <linux/rcuupdate.h> instead of <linux/rculist.h> in <linux/sched.h>

2017-03-02 08:42:38 +01:00

net: mpls: Fix nexthop alive tracking on down events

2017-03-16 20:22:18 -07:00

net/ncsi: Improve HNCDSC AEN handler

2016-10-20 11:23:08 -04:00

netfilter: nfnetlink_queue: fix secctx memory leak

2017-03-29 12:20:50 +02:00

netlabel: add CALIPSO to the list of built-in protocols

2017-01-06 22:20:45 -05:00

genetlink: fix counting regression on ctrl_dumpfamily()

2017-03-22 15:38:43 -07:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

openvswitch: Fix ovs_flow_key_update()

2017-04-01 12:16:46 -07:00

net/packet: fix overflow in check for tp_reserve

2017-03-30 11:04:00 -07:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

net: Introduce psample, a new genetlink channel for packet sampling

2017-01-24 13:44:28 -05:00

net: qrtr: Mark 'buf' as little endian

2017-01-10 20:45:04 -05:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

rfkill: remove rfkill-regulator

2017-01-24 11:07:35 +01:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

rxrpc: Ignore BUSY packets on old calls

2017-03-16 21:27:57 -07:00

net_sched: check noop_qdisc before qdisc_hash_add()

2017-04-06 12:28:39 -07:00

sctp: listen on the sock only when it's state is listening or closed

2017-04-06 13:55:51 -07:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

strparser: destroy workqueue on module exit

2017-03-03 20:43:26 -08:00

Merge tag 'nfsd-4.11-1' of git://linux-nfs.org/~bfields/linux

2017-04-01 10:43:37 -07:00

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-10-30 12:42:58 -04:00

tipc: fix nametbl deadlock at tipc_nametbl_unsubscribe

2017-03-22 11:59:16 -07:00

net: unix: properly re-increment inflight counter of GC discarded candidates

2017-03-21 15:25:10 -07:00

vsock: cancel packets when failing to connect

2017-03-21 14:41:47 -07:00

genetlink: mark families as __ro_after_init

2016-10-27 16:16:09 -04:00

cfg80211: check rdev resume callback only for registered wiphy

2017-03-29 09:11:29 +02:00

net: Work around lockdep limitation in sockets that use sockets

2017-03-09 18:23:27 -08:00

Merge branch 'apw' (xfrm_user fixes)

2017-03-29 13:26:22 -07:00

compat.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2017-02-22 10:15:09 -08:00

Kconfig

bpf: make jited programs visible in traces

2017-02-17 13:40:05 -05:00

Makefile

net: Introduce ife encapsulation module

2017-02-03 15:16:45 -05:00

socket.c

tcp: mark skbs with SCM_TIMESTAMPING_OPT_STATS

2017-03-21 18:44:17 -07:00

sysctl_net.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2016-10-06 09:52:23 -07:00