Re: [PATCH net] tcp: Fix potential use-after-free due to double kfree().

2021-01-20 Thread Jakub Kicinski
On Wed, 20 Jan 2021 14:07:35 +0100 Eric Dumazet wrote: > On Wed, Jan 20, 2021 at 2:17 AM Jakub Kicinski wrote: > > On Mon, 18 Jan 2021 14:59:20 +0900 Kuniyuki Iwashima wrote: > > > Receiving ACK with a valid SYN cookie, cookie_v4_check() allocates struct > > > request_sock and then can allocate

Re: [PATCH net] tcp: Fix potential use-after-free due to double kfree().

2021-01-20 Thread Eric Dumazet
On Wed, Jan 20, 2021 at 2:17 AM Jakub Kicinski wrote: > > On Mon, 18 Jan 2021 14:59:20 +0900 Kuniyuki Iwashima wrote: > > Receiving ACK with a valid SYN cookie, cookie_v4_check() allocates struct > > request_sock and then can allocate inet_rsk(req)->ireq_opt. After that, > > tcp_v4_syn_recv_sock()

Re: [PATCH net] tcp: Fix potential use-after-free due to double kfree().

2021-01-19 Thread Jakub Kicinski
On Mon, 18 Jan 2021 14:59:20 +0900 Kuniyuki Iwashima wrote: > Receiving ACK with a valid SYN cookie, cookie_v4_check() allocates struct > request_sock and then can allocate inet_rsk(req)->ireq_opt. After that, > tcp_v4_syn_recv_sock() allocates struct sock and copies ireq_opt to > inet_sk(sk)->inet

[PATCH net] tcp: Fix potential use-after-free due to double kfree().

2021-01-17 Thread Kuniyuki Iwashima
Receiving ACK with a valid SYN cookie, cookie_v4_check() allocates struct request_sock and then can allocate inet_rsk(req)->ireq_opt. After that, tcp_v4_syn_recv_sock() allocates struct sock and copies ireq_opt to inet_sk(sk)->inet_opt. Normally, tcp_v4_syn_recv_sock() inserts the full socket into