d28934ad8a
Thanks is due to Wei Yongjun for the detailed analysis and description of this bug at http://marc.info/?l=dccp&m=121739364909199&w=2 The problem is that invalid packets received by a client in state REQUEST cause the retransmission timer for the DCCP-Request to be reset. This includes freeing the Request-skb ( in dccp_rcv_request_sent_state_process() ). As a consequence, * the arrival of further packets cause a double-free, triggering a panic(), * the connection then may hang, since further retransmissions are blocked. This patch changes the order of statements so that the retransmission timer is reset, and the pending Request freed, only if a valid Response has arrived (or the number of sysctl-retries has been exhausted). Further changes: ---------------- To be on the safe side, replaced __kfree_skb with kfree_skb so that if due to unexpected circumstances the sk_send_head is NULL the WARN_ON is used instead. Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| ccids | ||
| Kconfig | ||
| Makefile | ||
| ackvec.c | ||
| ackvec.h | ||
| ccid.c | ||
| ccid.h | ||
| dccp.h | ||
| diag.c | ||
| feat.c | ||
| feat.h | ||
| input.c | ||
| ipv4.c | ||
| ipv6.c | ||
| ipv6.h | ||
| minisocks.c | ||
| options.c | ||
| output.c | ||
| probe.c | ||
| proto.c | ||
| sysctl.c | ||
| timer.c | ||