diff options
| author | Evgeniy Polyakov <johnpol@2ka.mipt.ru> | 2008-04-28 02:27:30 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-04-28 02:27:30 +0400 |
| commit | 9ae27e0adbf471c7a6b80102e38e1d5a346b3b38 (patch) | |
| tree | 54ef2bb504625e003a35dae8ebbeb4b755f52419 /drivers/scsi/gdth_proc.c | |
| parent | dae50295488f35d2d617b08a5fae43154c947eec (diff) | |
| download | linux-9ae27e0adbf471c7a6b80102e38e1d5a346b3b38.tar.xz | |
tcp: Fix slab corruption with ipv6 and tcp6fuzz
From: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
This fixes a regression added by ec3c0982a2dd1e671bad8e9d26c28dcba0039d87
("[TCP]: TCP_DEFER_ACCEPT updates - process as established")
tcp_v6_do_rcv()->tcp_rcv_established(), the latter goes to step5, where
eventually skb can be freed via tcp_data_queue() (drop: label), then if
check for tcp_defer_accept_check() returns true and thus
tcp_rcv_established() returns -1, which forces tcp_v6_do_rcv() to jump
to reset: label, which in turn will pass through discard: label and free
the same skb again.
Tested by Eric Sesterhenn.
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-By: Patrick McManus <mcmanus@ducksong.com>
Diffstat (limited to 'drivers/scsi/gdth_proc.c')
0 files changed, 0 insertions, 0 deletions