Please sign in to comment.
dccp: fix freeing skb too early for IPV6_RECVPKTINFO
In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet is forcibly freed via __kfree_skb in dccp_rcv_state_process if dccp_v6_conn_request successfully returns. However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb is saved to ireq->pktopts and the ref count for skb is incremented in dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed in dccp_rcv_state_process. Fix by calling consume_skb instead of doing goto discard and therefore calling __kfree_skb. Similar fixes for TCP: fb7e239 [TCP]: skb is unexpectedly freed. 0aea76d tcp: SYN packets are now simply consumed Signed-off-by: Andrey Konovalov <email@example.com> Acked-by: Eric Dumazet <firstname.lastname@example.org> Signed-off-by: David S. Miller <email@example.com>
- Loading branch information...