Merge: tcp: Fix use-after-free of nreq in reqsk_timer_handler().

jstancek · jstancek · commit c6709ef43660 · 2025-01-14T07:27:26.000+01:00
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/152 JIRA: https://issues.redhat.com/browse/RHEL-73194 Upstream Status: linux.git Signed-off-by: Guillaume Nault <gnault@redhat.com> Approved-by: Florian Westphal <fwestpha@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Jan Stancek <jstancek@redhat.com>
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
@@ -1189,7 +1189,7 @@ static void reqsk_timer_handler(struct timer_list *t)
 
 drop:
 	__inet_csk_reqsk_queue_drop(sk_listener, oreq, true);
-	reqsk_put(req);
+	reqsk_put(oreq);
 }
 
 static bool reqsk_queue_hash_req(struct request_sock *req,

Original file line number	Diff line number	Diff line change
`@@ -1189,7 +1189,7 @@ static void reqsk_timer_handler(struct timer_list *t)`
`1189`	`1189`
`1190`	`1190`	`drop:`
`1191`	`1191`	`__inet_csk_reqsk_queue_drop(sk_listener, oreq, true);`
`1192`		`- reqsk_put(req);`
	`1192`	`+ reqsk_put(oreq);`
`1193`	`1193`	`}`
`1194`	`1194`
`1195`	`1195`	`static bool reqsk_queue_hash_req(struct request_sock *req,`