Merge: tcp: Fix use-after-free of nreq in reqsk_timer_handler().

emmil · emmil · commit 0070c3cebb57 · 2024-12-18T14:26:03.000Z
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/5976 JIRA: https://issues.redhat.com/browse/RHEL-70449 Upstream Status: linux.git Signed-off-by: Guillaume Nault <gnault@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: Hangbin Liu <haliu@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Rado Vrbovsky <rvrbovsk@redhat.com>
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
@@ -938,7 +938,7 @@ static void reqsk_timer_handler(struct timer_list *t)
 
 drop:
 	__inet_csk_reqsk_queue_drop(sk_listener, oreq, true);
-	reqsk_put(req);
+	reqsk_put(oreq);
 }
 
 static void reqsk_queue_hash_req(struct request_sock *req,

Original file line number	Diff line number	Diff line change
`@@ -938,7 +938,7 @@ static void reqsk_timer_handler(struct timer_list *t)`
`938`	`938`
`939`	`939`	`drop:`
`940`	`940`	`__inet_csk_reqsk_queue_drop(sk_listener, oreq, true);`
`941`		`- reqsk_put(req);`
	`941`	`+ reqsk_put(oreq);`
`942`	`942`	`}`
`943`	`943`
`944`	`944`	`static void reqsk_queue_hash_req(struct request_sock *req,`