tcp: release sk_frag.page in tcp_disconnect

socket can be disconnected and gets transformed back to a listening socket, if sk_frag.page is not released, which will be cloned into a new socket by sk_clone_lock, but the reference count of this page is increased, lead to a use after free or double free issue Signed-off-by: Li RongQing <[email protected]> Cc: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]>
akeromi · Jan 29, 2018 · 9b42d55 · 9b42d55
1 parent 30e948a
commit 9b42d55
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
@@ -2458,6 +2458,12 @@ int tcp_disconnect(struct sock *sk, int flags)
 
 	WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 
+	if (sk->sk_frag.page) {
+		put_page(sk->sk_frag.page);
+		sk->sk_frag.page = NULL;
+		sk->sk_frag.offset = 0;
+	}
+
 	sk->sk_error_report(sk);
 	return err;
 }