Li RongQing 117991ed14 tcp: release sk_frag.page in tcp_disconnect ... [ Upstream commit 9b42d55a66d388e4dd5550107df051a9637564fc ] socket can be disconnected and gets transformed back to a listening socket, if sk_frag.page is not released, which will be cloned into a new socket by sk_clone_lock, but the reference count of this page is increased, lead to a use after free or double free issue Signed-off-by: Li RongQing <lirongqing@baidu.com> Cc: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-02-16 20:09:38 +01:00
..
netfilter	netfilter: fix IS_ERR_VALUE usage	2018-01-31 12:06:10 +01:00
af_inet.c	net: ping: do not abuse udp_poll()	2017-06-14 13:16:19 +02:00
ah4.c	IPsec: do not ignore crypto err in ah4 input	2017-11-15 17:13:10 +01:00
arp.c	ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY	2018-01-31 12:06:14 +01:00
cipso_ipv4.c	tcp/dccp: fix ireq->opt races	2017-11-18 11:11:06 +01:00
datagram.c	net: Set sk_txhash from a random number	2015-07-29 22:44:04 -07:00
devinet.c	ipv4: igmp: guard against silly MTU values	2018-01-02 20:33:24 +01:00
esp4.c	esp4: Fix integrity verification when ESN are used	2016-12-10 19:07:26 +01:00
fib_frontend.c	ipv4: Fix use-after-free when flushing FIB tables	2018-01-02 20:33:26 +01:00
fib_lookup.h	ipv4: consider TOS in fib_select_default	2015-07-24 22:46:11 -07:00
fib_rules.c	net: ipv6: use common fib_default_rule_pref	2015-09-09 14:19:50 -07:00
fib_semantics.c	ipv4: fix NULL dereference in free_fib_info_rcu()	2017-08-30 10:19:18 +02:00
fib_trie.c	net: Improve handling of failures on link and route dumps	2017-06-07 12:05:58 +02:00
fou.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
gre_demux.c	gre: Remove support for sharing GRE protocol hook.	2015-08-10 14:03:54 -07:00
gre_offload.c	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
icmp.c	Revert "ipv4/icmp: redirect messages can use the ingress daddr as source"	2015-10-14 06:01:07 -07:00
igmp.c	net: igmp: add a missing rcu locking section	2018-02-16 20:09:37 +01:00
inet_connection_sock.c	tcp/dccp: fix other lockdep splats accessing ireq_opt	2017-11-18 11:11:07 +01:00
inet_diag.c	tcp/dccp: install syn_recv requests into ehash table	2015-10-03 04:32:41 -07:00
inet_fragment.c	Revert "net: use lib/percpu_counter API for fragmentation mem accounting"	2017-09-27 11:00:11 +02:00
inet_hashtables.c	tcp/dccp: fix hashdance race for passive sessions	2015-10-23 05:42:21 -07:00
inet_lro.c
inet_timewait_sock.c	tcp/dccp: fix timewait races in timer handling	2015-09-21 16:32:29 -07:00
inetpeer.c	net: Add helper function to compare inetpeer addresses	2015-08-28 13:32:36 -07:00
ip_forward.c	net: Pass net into dst_output and remove dst_output_okfn	2015-10-08 04:26:54 -07:00
ip_fragment.c	inet: frag: release spinlock before calling icmp_send()	2017-12-25 14:22:11 +01:00
ip_gre.c	vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices	2016-06-24 10:18:18 -07:00
ip_input.c	ipv4: Pass struct net into ip_defrag and ip_check_defrag	2015-10-12 19:44:16 -07:00
ip_options.c	ipv4: coding style: comparison for inequality with NULL	2015-04-03 12:11:15 -04:00
ip_output.c	net: account for current skb length when deciding about UFO	2017-08-12 19:29:09 -07:00
ip_sockglue.c	net: Allow IP_MULTICAST_IF to set index to L3 slave	2017-11-30 08:37:26 +00:00
ip_tunnel.c	ipv4: igmp: guard against silly MTU values	2018-01-02 20:33:24 +01:00
ip_tunnel_core.c	tunnels: Remove encapsulation offloads on decap.	2016-10-31 04:13:59 -06:00
ip_vti.c	vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit	2017-10-21 17:09:02 +02:00
ipcomp.c	ipv4: coding style: comparison for equality with NULL	2015-04-03 12:11:15 -04:00
ipconfig.c	ipconfig: send Client-identifier in DHCP requests	2015-10-18 19:23:52 -07:00
ipip.c	ipip: only increase err_count for some certain type icmp in ipip_err	2017-11-18 11:11:06 +01:00
ipmr.c	ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route	2016-11-15 07:46:37 +01:00
Kconfig	geneve: Consolidate Geneve functionality in single module.	2015-08-27 15:42:48 -07:00
Makefile	tcp: track the packet timings in RACK	2015-10-21 07:00:48 -07:00
netfilter.c	ipv4: Pass struct net into ip_route_me_harder	2015-09-29 20:21:32 +02:00
ping.c	ping: implement proper locking	2017-04-30 05:49:29 +02:00
proc.c	net: track success and failure of TCP PMTU probing	2015-07-21 22:36:33 -07:00
protocol.c
raw.c	net: ipv4: fix for a race condition in raw_sendmsg	2018-01-02 20:33:25 +01:00
route.c	route: update fnhe_expires for redirect when the fnhe exists	2017-12-16 10:33:54 +01:00
syncookies.c	tcp/dccp: fix ireq->opt races	2017-11-18 11:11:06 +01:00
sysctl_net_ipv4.c	ipv4: use the right lock for ping_group_range	2016-11-15 07:46:38 +01:00
tcp.c	tcp: release sk_frag.page in tcp_disconnect	2018-02-16 20:09:38 +01:00
tcp_bic.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_cdg.c	tcp: do not slow start when cwnd equals ssthresh	2015-07-09 14:22:52 -07:00
tcp_cong.c	tcp: disallow cwnd undo when switching congestion control	2017-06-14 13:16:19 +02:00
tcp_cubic.c	tcp_cubic: do not set epoch_start in the future	2015-09-17 22:35:07 -07:00
tcp_dctcp.c	dctcp: avoid bogus doubling of cwnd after loss	2016-11-21 10:06:39 +01:00
tcp_diag.c	tcp: ensure proper barriers in lockless contexts	2015-11-15 18:36:38 -05:00
tcp_fastopen.c	tcp: initialize max window for a new fastopen socket	2017-02-04 09:45:09 +01:00
tcp_highspeed.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_htcp.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_hybla.c	tcp: do not slow start when cwnd equals ssthresh	2015-07-09 14:22:52 -07:00
tcp_illinois.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_input.c	tcp: correct memory barrier usage in tcp_check_space()	2017-12-09 18:42:43 +01:00
tcp_ipv4.c	tcp md5sig: Use skb's saddr when replying to an incoming segment	2018-01-02 20:33:25 +01:00
tcp_lp.c	tcp: fix wraparound issue in tcp_lp	2017-05-14 13:32:58 +02:00
tcp_memcontrol.c	memcg: cleanup static keys decrement	2015-02-12 18:54:10 -08:00
tcp_metrics.c	tcp: convert cached rtt from usec to jiffies when feeding initial rto	2016-04-20 15:41:56 +09:00
tcp_minisocks.c	tcp: do not inherit fastopen_req from parent	2017-05-14 13:32:58 +02:00
tcp_offload.c	tcp: reserve tcp_skb_mss() to tcp stack	2015-06-11 16:33:10 -07:00
tcp_output.c	tcp: do not mangle skb->cb[] in tcp_make_synack()	2017-11-24 08:32:23 +01:00
tcp_probe.c
tcp_recovery.c	tcp: use RACK to detect losses	2015-10-21 07:00:53 -07:00
tcp_scalable.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_timer.c	net: tcp: close sock if net namespace is exiting	2018-01-31 12:06:14 +01:00
tcp_vegas.c	tcp: fix under-evaluated ssthresh in TCP Vegas	2017-12-25 14:22:15 +01:00
tcp_vegas.h	tcp: prepare CC get_info() access from getsockopt()	2015-04-29 17:10:38 -04:00
tcp_veno.c	tcp: add tcp_in_slow_start helper	2015-07-09 14:22:52 -07:00
tcp_westwood.c	tcp_westwood: fix tcp_westwood_info()	2015-05-05 19:50:09 -04:00
tcp_yeah.c	tcp: cwnd does not increase in TCP YeAH	2016-09-30 10:18:34 +02:00
tunnel4.c
udp.c	udp: consistently apply ufo or fragmentation	2017-08-12 19:29:09 -07:00
udp_diag.c	sock_diag: specify info_size per inet protocol	2015-06-15 19:49:22 -07:00
udp_impl.h	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
udp_offload.c	net: avoid skb_warn_bad_offload false positives on UFO	2017-08-12 19:29:08 -07:00
udp_tunnel.c	tunnel: Clear IPCB(skb)->opt before dst_link_failure called	2016-04-20 15:41:56 +09:00
udplite.c
xfrm4_input.c	netfilter: Pass net into okfn	2015-09-17 17:18:37 -07:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c	ipv4: hash net ptr into fragmentation bucket selection	2015-03-25 14:07:04 -04:00
xfrm4_output.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-10-24 06:54:12 -07:00
xfrm4_policy.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2015-12-22 16:26:31 -05:00
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c