Lin, Zhenpeng a1bb3c064b dccp: don't duplicate ccid when cloning dccp sock ... commit d9ea761fdd upstream. Commit 2677d20677 ("dccp: don't free ccid2_hc_tx_sock ...") fixed a UAF but reintroduced CVE-2017-6074. When the sock is cloned, two dccps_hc_tx_ccid will reference to the same ccid. So one can free the ccid object twice from two socks after cloning. This issue was found by "Hadar Manor" as well and assigned with CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port the patch from Ubuntu to fix it. The patch prevents cloned socks from referencing the same ccid. Fixes: 2677d20677 ("dccp: don't free ccid2_hc_tx_sock ...") Signed-off-by: Zhenpeng Lin <zplin@psu.edu> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-09-22 11:45:33 +02:00
..
ccids	dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()	2018-08-22 07:46:08 +02:00
ackvec.c
ackvec.h
ccid.c
ccid.h	dccp: fool proof ccid_hc_[rt]x_parse_options()	2019-02-12 19:46:10 +01:00
dccp.h	dccp: add do-while-0 stubs for dccp_pr_debug macros	2021-08-26 08:37:08 -04:00
diag.c
feat.c	dccp: Fix memleak in __feat_register_sp	2020-01-17 19:45:43 +01:00
feat.h
input.c	tcp/dccp: fix lockdep issue when SYN is backlogged	2018-10-18 09:16:20 +02:00
ipv4.c	inet: stop leaking jiffies on the wire	2019-11-10 11:25:37 +01:00
ipv6.c	ipv6: weaken the v4mapped source check	2021-04-07 12:47:00 +02:00
ipv6.h
Kconfig
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
minisocks.c	dccp: don't duplicate ccid when cloning dccp sock	2021-09-22 11:45:33 +02:00
options.c	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
output.c	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
probe.c	Use 64-bit timekeeping	2015-11-01 17:01:16 -05:00
proto.c	dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()	2018-06-11 22:49:18 +02:00
qpolicy.c
sysctl.c
timer.c	dccp: fix tasklet usage	2018-05-19 10:20:23 +02:00