Messages in this thread | | | Date | Tue, 22 Dec 2015 15:34:25 -0500 (EST) | Subject | Re: [PATCH] dccp: fix use-after-free after cloning struct dccp_sock | From | David Miller <> |
| |
From: Vegard Nossum <vegard.nossum@oracle.com> Date: Sun, 20 Dec 2015 21:53:27 +0100
> @@ -115,6 +115,10 @@ struct sock *dccp_create_openreq_child(const struct sock *sk, > newdp->dccps_isr = dreq->dreq_isr; > newdp->dccps_gsr = dreq->dreq_gsr; > > + newdp->dccps_hc_rx_ackvec = NULL; > + newdp->dccps_hc_rx_ccid = NULL; > + newdp->dccps_hc_tx_ccid = NULL;
->dccps_hc_rx_ackvec is set to NULL several lines above this, so you don't need to add that case here.
WRT the ccid pointers, I don't think we can just NULL them out.
If the parent socket has these CCID features enabled, we have to clone them into the child somehow.
| |