diff options
| author | Florian Westphal <fw@strlen.de> | 2020-12-11 01:25:02 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2020-12-15 04:30:06 +0300 |
| commit | ab82e996a1fa1b9ae514fa357d9ce8df62321157 (patch) | |
| tree | 5559cd85ee60dc779980c70a28e3f7aea64c6caf /net/ipv4/tcp_input.c | |
| parent | ba34c3de71ced1582dee55f2fae8638a3655d957 (diff) | |
| download | linux-ab82e996a1fa1b9ae514fa357d9ce8df62321157.tar.xz | |
mptcp: hold mptcp socket before calling tcp_done
When processing options from tcp reset path its possible that
tcp_done(ssk) drops the last reference on the mptcp socket which
results in use-after-free.
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/ipv4/tcp_input.c')
0 files changed, 0 insertions, 0 deletions