From: Evgeniy Polyakov <johnpol@2ka.mipt.ru>
Date: Sun, 27 Apr 2008 22:27:30 +0000 (-0700)
Subject: tcp: Fix slab corruption with ipv6 and tcp6fuzz
X-Git-Tag: v2.6.26-rc1~715^2~2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9ae27e0adbf471c7a6b80102e38e1d5a346b3b38;p=pandora-kernel.git

tcp: Fix slab corruption with ipv6 and tcp6fuzz

From: Evgeniy Polyakov <johnpol@2ka.mipt.ru>

This fixes a regression added by ec3c0982a2dd1e671bad8e9d26c28dcba0039d87
("[TCP]: TCP_DEFER_ACCEPT updates - process as established")

tcp_v6_do_rcv()->tcp_rcv_established(), the latter goes to step5, where
eventually skb can be freed via tcp_data_queue() (drop: label), then if
check for tcp_defer_accept_check() returns true and thus
tcp_rcv_established() returns -1, which forces tcp_v6_do_rcv() to jump
to reset: label, which in turn will pass through discard: label and free
the same skb again.

Tested by Eric Sesterhenn.

Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-By: Patrick McManus <mcmanus@ducksong.com>
---

Reading git-diff-tree failed