diff options
| author | Eric Dumazet <edumazet@google.com> | 2015-08-11 00:07:34 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-08-11 06:17:45 +0200 |
| commit | 3257d8b12f954c462d29de6201664a846328a522 (patch) | |
| tree | 95c8d45df7f0a2919a0c7bd363dc94a57dcddf05 /net/decnet | |
| parent | inet: fix races with reqsk timers (diff) | |
| download | linux-3257d8b12f954c462d29de6201664a846328a522.tar.xz linux-3257d8b12f954c462d29de6201664a846328a522.zip | |
inet: fix possible request socket leak
In commit b357a364c57c9 ("inet: fix possible panic in
reqsk_queue_unlink()"), I missed fact that tcp_check_req()
can return the listener socket in one case, and that we must
release the request socket refcount or we leak it.
Tested:
Following packetdrill test template shows the issue
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0 bind(3, ..., ...) = 0
+0 listen(3, 1) = 0
+0 < S 0:0(0) win 2920 <mss 1460,sackOK,nop,nop>
+0 > S. 0:0(0) ack 1 <mss 1460,nop,nop,sackOK>
+.002 < . 1:1(0) ack 21 win 2920
+0 > R 21:21(0)
Fixes: b357a364c57c9 ("inet: fix possible panic in reqsk_queue_unlink()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/decnet')
0 files changed, 0 insertions, 0 deletions