From: Eric Dumazet <[email protected]> Date: Fri, 09 Oct 2015 11:29:32 -0700
> From: Eric Dumazet <[email protected]> > > Recent TCP listener patches exposed a prior af_packet bug : > match_fanout_group() blindly assumes it is always safe > to cast sk to a packet socket to compare fanout with af_packet_priv > > But SYNACK packets can be sent while attached to request_sock, which > are smaller than a "struct sock". > > We can read non existent memory and crash. > > Fixes: c0de08d04215 ("af_packet: don't emit packet on orig fanout group") > Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead > of listener") > Signed-off-by: Eric Dumazet <[email protected]> Applied, thanks Eric. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
