mptcp: hold mptcp socket before calling tcp_done

Browse source

When processing options from tcp reset path its possible that
tcp_done(ssk) drops the last reference on the mptcp socket which
results in use-after-free.

Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

...

This commit is contained in:

Florian Westphal 2020-12-10 14:25:02 -08:00 • committed by Jakub Kicinski

parent ba34c3de71

commit ab82e996a1

1 changed files with 6 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

net/mptcp/subflow.c

View file