Please sign in to comment.
dccp/tcp: do not inherit mc_list from parent
syzkaller found a way to trigger double frees from ip_mc_drop_socket() It turns out that leave a copy of parent mc_list at accept() time, which is very bad. Very similar to commit 8b485ce ("tcp: do not inherit fastopen_req from parent") Initial report from Pray3r, completed by Andrey one. Thanks a lot to them ! Signed-off-by: Eric Dumazet <email@example.com> Reported-by: Pray3r <firstname.lastname@example.org> Reported-by: Andrey Konovalov <email@example.com> Tested-by: Andrey Konovalov <firstname.lastname@example.org> Signed-off-by: David S. Miller <email@example.com>
- Loading branch information...