Eric Dumazet 78c4e3d484 tcp: clear saved_syn in tcp_disconnect() ... [ Upstream commit 17c3060b1701fc69daedb4c90be6325d3d9fca8e ] In the (very unlikely) case a passive socket becomes a listener, we do not want to duplicate its saved SYN headers. This would lead to double frees, use after free, and please hackers and various fuzzers Tested: 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, IPPROTO_TCP, TCP_SAVE_SYN, [1], 4) = 0 +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 5) = 0 +0 < S 0:0(0) win 32972 <mss 1460,nop,wscale 7> +0 > S. 0:0(0) ack 1 <...> +.1 < . 1:1(0) ack 1 win 257 +0 accept(3, ..., ...) = 4 +0 connect(4, AF_UNSPEC, ...) = 0 +0 close(3) = 0 +0 bind(4, ..., ...) = 0 +0 listen(4, 5) = 0 +0 < S 0:0(0) win 32972 <mss 1460,nop,wscale 7> +0 > S. 0:0(0) ack 1 <...> +.1 < . 1:1(0) ack 1 win 257 Fixes: cd8ae85299 ("tcp: provide SYN headers for passive connections") Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-05-02 21:19:53 -07:00
..
6lowpan
9p
802
8021q	net: add recursion limit to GRO	2016-11-15 07:46:38 +01:00
appletalk
atm
ax25	ax25: Fix segfault after sock connection timeout	2017-02-04 09:45:09 +01:00
batman-adv	batman-adv: Check for alloc errors when preparing TT local data	2016-12-15 08:49:23 -08:00
bluetooth	Bluetooth: Fix l2cap_sock_setsockopt() with optname BT_RCVMTU	2016-08-20 18:09:19 +02:00
bridge	bridge: drop netfilter fake rtable unconditionally	2017-03-22 12:04:17 +01:00
caif	net: caif: fix misleading indentation	2016-09-30 10:18:35 +02:00
can	can: Fix kernel panic at security_sock_rcv_skb	2017-02-18 16:39:26 +01:00
ceph	libceph: force GFP_NOIO for socket allocations	2017-04-08 09:53:30 +02:00
core	net: neigh: guard against NULL solicit() method	2017-05-02 21:19:51 -07:00
dcb
dccp	dccp: fix memory leak during tear-down of unsuccessful connection request	2017-03-22 12:04:17 +01:00
decnet	decnet: Do not build routes to devices without decnet private data.	2016-05-18 17:06:35 -07:00
dns_resolver
dsa	net: dsa: Bring back device detaching in dsa_slave_suspend()	2017-02-04 09:45:10 +01:00
ethernet	net: introduce device min_header_len	2017-02-18 16:39:27 +01:00
hsr
ieee802154
ipv4	tcp: clear saved_syn in tcp_disconnect()	2017-05-02 21:19:53 -07:00
ipv6	net: ipv6: check route protocol when deleting routes	2017-04-21 09:30:08 +02:00
ipx
irda	irda: Fix lockdep annotations in hashbin_delete().	2017-02-26 11:07:50 +01:00
iucv
key
l2tp	l2tp: fix PPP pseudo-wire auto-loading	2017-05-02 21:19:52 -07:00
l3mdev
lapb
llc	net/llc: avoid BUG_ON() in skb_orphan()	2017-02-26 11:07:49 +01:00
mac80211	mac80211: reject ToDS broadcast data frames	2017-04-27 09:09:33 +02:00
mac802154
mpls	mpls: Send route delete notifications when router module is unloaded	2017-03-22 12:04:16 +01:00
netfilter	netfilter: nfnetlink: correctly validate length of batch messages	2017-04-30 05:49:28 +02:00
netlabel	netlabel: add address family checks to netlbl_{sock,req}_delattr()	2016-08-20 18:09:22 +02:00
netlink	netlink: remove mmapped netlink support	2017-03-22 12:04:13 +01:00
netrom
nfc
openvswitch	net/openvswitch: Set the ipv6 source tunnel key address attribute correctly	2017-03-30 09:35:12 +02:00
packet	net/packet: fix overflow in check for tp_reserve	2017-05-02 21:19:51 -07:00
phonet
rds	RDS: Fix the atomicity for congestion map update	2017-05-02 21:19:49 -07:00
rfkill
rose
rxrpc
sched	net_sched: close another race condition in tcf_mirred_release()	2017-05-02 21:19:49 -07:00
sctp	sctp: listen on the sock only when it's state is listening or closed	2017-05-02 21:19:52 -07:00
sunrpc	SUNRPC: fix refcounting problems with auth_gss messages.	2017-04-21 09:30:08 +02:00
switchdev	switchdev: pass pointer to fib_info instead of copy	2016-06-24 10:18:16 -07:00
tipc	tipc: check minimum bearer MTU	2017-04-30 05:49:28 +02:00
unix	net: unix: properly re-increment inflight counter of GC discarded candidates	2017-03-30 09:35:13 +02:00
vmw_vsock	VSOCK: Detach QP check should filter out non matching QPs.	2017-04-27 09:09:32 +02:00
wimax
wireless	nl80211: fix dumpit error path RTNL deadlocks	2017-03-30 09:35:18 +02:00
x25	net: fix a kernel infoleak in x25 module	2016-05-18 17:06:43 -07:00
xfrm	xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder	2017-03-31 09:49:52 +02:00
compat.c
Kconfig
Makefile
socket.c	net: socket: fix recvmmsg not returning error from sock_error	2017-02-26 11:07:50 +01:00
sysctl_net.c	net: Use ns_capable_noaudit() when determining net sysctl permissions	2016-09-15 08:27:50 +02:00