[PATCH 2/3] fix panic in tcp_close()
flat view
STALE5054d
From: Weiping Pan <hidden>
Date: 2012-12-05 02:54:29
Subsystem:
networking [general], networking [tcp], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Neal Cardwell, Linus Torvalds
For tcp friends data skb, it has no tcp header, and its transport_header is NULL, so it will panic if we deference tcp_hdr(skb) in tcp_close(). So I add a check before we use tcp_hdr(). Signed-off-by: Weiping Pan <redacted> --- net/ipv4/tcp.c | 6 +++++- 1 files changed, 5 insertions(+), 1 deletions(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 4327deb..e9d82e0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c@@ -2512,8 +2512,12 @@ void tcp_close(struct sock *sk, long timeout) * reader process may not have drained the data yet! */ while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) { - u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq - + u32 len; + if (tcp_hdr(skb)) + len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq - tcp_hdr(skb)->fin; + else + len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq; data_was_unread += len; __kfree_skb(skb); }
--
1.7.4.4