tree 3ffeda8c61a7e27e4a23c611955d9585d95b1d67
parent 2a5cc53ea19ee8c8364a291745f73832673d2c04
author Wei Wang <weiwan@google.com> 1488403788 -0800
committer Dmitry Shmidt <dimitrysh@google.com> 1518721624 +0000

BACKPORT: tcp: fix potential double free issue for fastopen_req

commit 7db92362d2fee5887f6b0c41653b8c9f8f5d6020 upstream.

tp->fastopen_req could potentially be double freed if a malicious
user does the following:
1. Enable TCP_FASTOPEN_CONNECT sockopt and do a connect() on the socket.
2. Call connect() with AF_UNSPEC to disconnect the socket.
3. Make this socket a listening socket by calling listen().
4. Accept incoming connections and generate child sockets. All child
   sockets will get a copy of the pointer of fastopen_req.
5. Call close() on all sockets. fastopen_req will get freed multiple
   times.

Fixes: 19f6d3f3c842 ("net/tcp-fastopen: Add new API support")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Change-Id: I6bb174d6997470643df5ba34e1f9858e16f4989d
Fixes: Change-Id: Icc181febd74e3117c2fc835d7ed935e107b5815e
       ("BACKPORT: net/tcp-fastopen: Add new API support")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>