net: tcp: reset 'drop_reason' to NOT_SPCIFIED in tcp_v{4,6}_rcv()
The 'drop_reason' that passed to kfree_skb_reason() in tcp_v4_rcv()
and tcp_v6_rcv() can be SKB_NOT_DROPPED_YET(0), as it is used as the
return value of tcp_inbound_md5_hash().
And it can panic the kernel with NULL pointer in
net_dm_packet_report_size() if the reason is 0, as drop_reasons[0]
is NULL.
Fixes: 1330b6ef33
("skb: make drop reason booleanable")
Reviewed-by: Jiang Biao <benbjiang@tencent.com>
Reviewed-by: Hao Peng <flyingpeng@tencent.com>
Signed-off-by: Menglong Dong <imagedong@tencent.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Родитель
7ebd3f3ee5
Коммит
f8319dfd1b
|
@ -2101,6 +2101,7 @@ bad_packet:
|
|||
}
|
||||
|
||||
discard_it:
|
||||
SKB_DR_OR(drop_reason, NOT_SPECIFIED);
|
||||
/* Discard frame. */
|
||||
kfree_skb_reason(skb, drop_reason);
|
||||
return 0;
|
||||
|
|
|
@ -1509,6 +1509,7 @@ reset:
|
|||
discard:
|
||||
if (opt_skb)
|
||||
__kfree_skb(opt_skb);
|
||||
SKB_DR_OR(reason, NOT_SPECIFIED);
|
||||
kfree_skb_reason(skb, reason);
|
||||
return 0;
|
||||
csum_err:
|
||||
|
|
Загрузка…
Ссылка в новой задаче