From: Eric Dumazet <eric.duma...@gmail.com>
Date: Fri, 09 Oct 2015 11:29:32 -0700
> From: Eric Dumazet <eduma...@google.com>
>
> Recent TCP listener patches exposed a prior af_packet bug :
> match_fanout_group() blindly assumes it is always safe
> to cast sk to a packet socket to compare fanout with af_packet_priv
>
> But SYNACK packets can be sent while attached to request_sock, which
> are smaller than a "struct sock".
>
> We can read non existent memory and crash.
>
> Fixes: c0de08d04215 ("af_packet: don't emit packet on orig fanout group")
> Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead
> of listener")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
Applied, thanks Eric.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
