netdev - Re: [Patch net] tcp: reset sk_rx_dst in tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170625.122335.2262782871024243094.davem@davemloft.net>
Date:   Sun, 25 Jun 2017 12:23:35 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     xiyou.wangcong@...il.com
Cc:     netdev@...r.kernel.org, avagin@...il.com, kaiwen.xu@...u.com
Subject: Re: [Patch net] tcp: reset sk_rx_dst in tcp_disconnect()

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Sat, 24 Jun 2017 23:50:30 -0700

> We have to reset the sk->sk_rx_dst when we disconnect a TCP
> connection, because otherwise when we re-connect it this
> dst reference is simply overridden in tcp_finish_connect().
> 
> This fixes a dst leak which leads to a loopback dev refcnt
> leak. It is a long-standing bug, Kevin reported a very similar
> (if not same) bug before. Thanks to Andrei for providing such
> a reliable reproducer which greatly narrows down the problem.
> 
> Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.")
> Reported-by: Andrei Vagin <avagin@...il.com>
> Reported-by: Kevin Xu <kaiwen.xu@...u.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Applied and queued up for -stable, thanks!