dccp/tcp: do not inherit mc_list from parent
syzkaller found a way to trigger double frees from ip_mc_drop_socket() It turns out that leave a copy of parent mc_list at accept() time, which is very bad. Very similar to commit 8b485ce69876 ("tcp: do not inherit fastopen_req from parent") Initial report from Pray3r, completed by Andrey one. Thanks a lot to them ! Change-Id: I9ab96385fcbcad25d3e6829927d586b91d22afe8 Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Pray3r <pray3r.z@gmail.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
97c0aca710
commit
aae7bf925a
|
@ -697,6 +697,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
|
|||
inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port;
|
||||
newsk->sk_write_space = sk_stream_write_space;
|
||||
|
||||
inet_sk(newsk)->mc_list = NULL;
|
||||
|
||||
newsk->sk_mark = inet_rsk(req)->ir_mark;
|
||||
|
||||
newicsk->icsk_retransmits = 0;
|
||||
|
|
Loading…
Reference in New Issue