Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c3658e8d authored Nov 25, 2014 by Eric Dumazet Committed by David S. Miller Nov 25, 2014

tcp: fix possible NULL dereference in tcp_vX_send_reset()

After commit ca777eff ("tcp: remove dst refcount false sharing for
prequeue mode") we have to relax check against skb dst in
tcp_v[46]_send_reset() if prequeue dropped the dst.

If a socket is provided, a full lookup was done to find this socket,
so the dst test can be skipped.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88191


Reported-by: Jaša Bartelj <jasa.bartelj@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Daniel Borkmann <dborkman@redhat.com>
Fixes: ca777eff ("tcp: remove dst refcount false sharing for prequeue mode")
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 43612d7c

net/ipv4/tcp_ipv4.c

+4 −1

Original line number	Original line	Diff line number	Diff line
	@@ -598,7 +598,10 @@ static void tcp_v4_send_reset(struct sock sk, struct sk_buff skb)
	if (th->rst)		if (th->rst)
	return;		return;

	if (skb_rtable(skb)->rt_type != RTN_LOCAL)		/* If sk not NULL, it means we did a successful lookup and incoming
			* route had to be correct. prequeue might have dropped our dst.
			*/
			if (!sk && skb_rtable(skb)->rt_type != RTN_LOCAL)
	return;		return;

	/* Swap the send and the receive. */		/* Swap the send and the receive. */

net/ipv6/tcp_ipv6.c

+4 −1

Original line number	Original line	Diff line number	Diff line
	@@ -903,7 +903,10 @@ static void tcp_v6_send_reset(struct sock sk, struct sk_buff skb)
	if (th->rst)		if (th->rst)
	return;		return;

	if (!ipv6_unicast_destination(skb))		/* If sk not NULL, it means we did a successful lookup and incoming
			* route had to be correct. prequeue might have dropped our dst.
			*/
			if (!sk && !ipv6_unicast_destination(skb))
	return;		return;

	#ifdef CONFIG_TCP_MD5SIG		#ifdef CONFIG_TCP_MD5SIG