Li RongQing 117991ed14 tcp: release sk_frag.page in tcp_disconnect ...

[ Upstream commit 9b42d55a66 ]

socket can be disconnected and gets transformed back to a listening
socket, if sk_frag.page is not released, which will be cloned into
a new socket by sk_clone_lock, but the reference count of this page
is increased, lead to a use after free or double free issue

Signed-off-by: Li RongQing <lirongqing@baidu.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-02-16 20:09:38 +01:00

..

netfilter

netfilter: fix IS_ERR_VALUE usage

2018-01-31 12:06:10 +01:00

af_inet.c

net: ping: do not abuse udp_poll()

2017-06-14 13:16:19 +02:00

ah4.c

IPsec: do not ignore crypto err in ah4 input

2017-11-15 17:13:10 +01:00

arp.c

ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY

2018-01-31 12:06:14 +01:00

cipso_ipv4.c

tcp/dccp: fix ireq->opt races

2017-11-18 11:11:06 +01:00

datagram.c

…

devinet.c

ipv4: igmp: guard against silly MTU values

2018-01-02 20:33:24 +01:00

esp4.c

esp4: Fix integrity verification when ESN are used

2016-12-10 19:07:26 +01:00

fib_frontend.c

ipv4: Fix use-after-free when flushing FIB tables

2018-01-02 20:33:26 +01:00

fib_lookup.h

…

fib_rules.c

net: ipv6: use common fib_default_rule_pref

2015-09-09 14:19:50 -07:00

fib_semantics.c

ipv4: fix NULL dereference in free_fib_info_rcu()

2017-08-30 10:19:18 +02:00

fib_trie.c

net: Improve handling of failures on link and route dumps

2017-06-07 12:05:58 +02:00

fou.c

net: add recursion limit to GRO

2016-11-15 07:46:38 +01:00

gre_demux.c

…

gre_offload.c

net: add recursion limit to GRO

2016-11-15 07:46:38 +01:00

icmp.c

Revert "ipv4/icmp: redirect messages can use the ingress daddr as source"

2015-10-14 06:01:07 -07:00

igmp.c

net: igmp: add a missing rcu locking section

2018-02-16 20:09:37 +01:00

inet_connection_sock.c

tcp/dccp: fix other lockdep splats accessing ireq_opt

2017-11-18 11:11:07 +01:00

inet_diag.c

tcp/dccp: install syn_recv requests into ehash table

2015-10-03 04:32:41 -07:00

inet_fragment.c

Revert "net: use lib/percpu_counter API for fragmentation mem accounting"

2017-09-27 11:00:11 +02:00

inet_hashtables.c

tcp/dccp: fix hashdance race for passive sessions

2015-10-23 05:42:21 -07:00

inet_lro.c

…

inet_timewait_sock.c

tcp/dccp: fix timewait races in timer handling

2015-09-21 16:32:29 -07:00

inetpeer.c

net: Add helper function to compare inetpeer addresses

2015-08-28 13:32:36 -07:00

ip_forward.c

net: Pass net into dst_output and remove dst_output_okfn

2015-10-08 04:26:54 -07:00

ip_fragment.c

inet: frag: release spinlock before calling icmp_send()

2017-12-25 14:22:11 +01:00

ip_gre.c

vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices

2016-06-24 10:18:18 -07:00

ip_input.c

ipv4: Pass struct net into ip_defrag and ip_check_defrag

2015-10-12 19:44:16 -07:00

ip_options.c

…

ip_output.c

net: account for current skb length when deciding about UFO

2017-08-12 19:29:09 -07:00

ip_sockglue.c

net: Allow IP_MULTICAST_IF to set index to L3 slave

2017-11-30 08:37:26 +00:00

ip_tunnel_core.c

tunnels: Remove encapsulation offloads on decap.

2016-10-31 04:13:59 -06:00

ip_tunnel.c

ipv4: igmp: guard against silly MTU values

2018-01-02 20:33:24 +01:00

ip_vti.c

vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit

2017-10-21 17:09:02 +02:00

ipcomp.c

…

ipconfig.c

ipconfig: send Client-identifier in DHCP requests

2015-10-18 19:23:52 -07:00

ipip.c

ipip: only increase err_count for some certain type icmp in ipip_err

2017-11-18 11:11:06 +01:00

ipmr.c

ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route

2016-11-15 07:46:37 +01:00

Kconfig

…

Makefile

tcp: track the packet timings in RACK

2015-10-21 07:00:48 -07:00

netfilter.c

ipv4: Pass struct net into ip_route_me_harder

2015-09-29 20:21:32 +02:00

ping.c

ping: implement proper locking

2017-04-30 05:49:29 +02:00

proc.c

…

protocol.c

…

raw.c

net: ipv4: fix for a race condition in raw_sendmsg

2018-01-02 20:33:25 +01:00

route.c

route: update fnhe_expires for redirect when the fnhe exists

2017-12-16 10:33:54 +01:00

syncookies.c

tcp/dccp: fix ireq->opt races

2017-11-18 11:11:06 +01:00

sysctl_net_ipv4.c

ipv4: use the right lock for ping_group_range

2016-11-15 07:46:38 +01:00

tcp_bic.c

…

tcp_cdg.c

…

tcp_cong.c

tcp: disallow cwnd undo when switching congestion control

2017-06-14 13:16:19 +02:00

tcp_cubic.c

tcp_cubic: do not set epoch_start in the future

2015-09-17 22:35:07 -07:00

tcp_dctcp.c

dctcp: avoid bogus doubling of cwnd after loss

2016-11-21 10:06:39 +01:00

tcp_diag.c

tcp: ensure proper barriers in lockless contexts

2015-11-15 18:36:38 -05:00

tcp_fastopen.c

tcp: initialize max window for a new fastopen socket

2017-02-04 09:45:09 +01:00

tcp_highspeed.c

…

tcp_htcp.c

…

tcp_hybla.c

…

tcp_illinois.c

…

tcp_input.c

tcp: correct memory barrier usage in tcp_check_space()

2017-12-09 18:42:43 +01:00

tcp_ipv4.c

tcp md5sig: Use skb's saddr when replying to an incoming segment

2018-01-02 20:33:25 +01:00

tcp_lp.c

tcp: fix wraparound issue in tcp_lp

2017-05-14 13:32:58 +02:00

tcp_memcontrol.c

…

tcp_metrics.c

tcp: convert cached rtt from usec to jiffies when feeding initial rto

2016-04-20 15:41:56 +09:00

tcp_minisocks.c

tcp: do not inherit fastopen_req from parent

2017-05-14 13:32:58 +02:00

tcp_offload.c

…

tcp_output.c

tcp: do not mangle skb->cb[] in tcp_make_synack()

2017-11-24 08:32:23 +01:00

tcp_probe.c

…

tcp_recovery.c

tcp: use RACK to detect losses

2015-10-21 07:00:53 -07:00

tcp_scalable.c

…

tcp_timer.c

net: tcp: close sock if net namespace is exiting

2018-01-31 12:06:14 +01:00

tcp_vegas.c

tcp: fix under-evaluated ssthresh in TCP Vegas

2017-12-25 14:22:15 +01:00

tcp_vegas.h

…

tcp_veno.c

…

tcp_westwood.c

…

tcp_yeah.c

tcp: cwnd does not increase in TCP YeAH

2016-09-30 10:18:34 +02:00

tcp.c

tcp: release sk_frag.page in tcp_disconnect

2018-02-16 20:09:38 +01:00

tunnel4.c

…

udp_diag.c

…

udp_impl.h

…

udp_offload.c

net: avoid skb_warn_bad_offload false positives on UFO

2017-08-12 19:29:08 -07:00

udp_tunnel.c

tunnel: Clear IPCB(skb)->opt before dst_link_failure called

2016-04-20 15:41:56 +09:00

udp.c

udp: consistently apply ufo or fragmentation

2017-08-12 19:29:09 -07:00

udplite.c

…

xfrm4_input.c

netfilter: Pass net into okfn

2015-09-17 17:18:37 -07:00

xfrm4_mode_beet.c

…

xfrm4_mode_transport.c

…

xfrm4_mode_tunnel.c

…

xfrm4_output.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-10-24 06:54:12 -07:00

xfrm4_policy.c

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

2015-12-22 16:26:31 -05:00

xfrm4_protocol.c

…

xfrm4_state.c

…

xfrm4_tunnel.c

…