projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ba34c3d) | patch
mptcp: hold mptcp socket before calling tcp_done
authorFlorian Westphal <fw@strlen.de>
Thu, 10 Dec 2020 22:25:02 +0000 (14:25 -0800)
committerJakub Kicinski <kuba@kernel.org>
Tue, 15 Dec 2020 01:30:06 +0000 (17:30 -0800)
commitab82e996a1fa1b9ae514fa357d9ce8df62321157
tree5559cd85ee60dc779980c70a28e3f7aea64c6caftree | snapshot
parentba34c3de71ced1582dee55f2fae8638a3655d957commit | diff
mptcp: hold mptcp socket before calling tcp_done

When processing options from tcp reset path its possible that
tcp_done(ssk) drops the last reference on the mptcp socket which
results in use-after-free.

Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/mptcp/subflow.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git