From: Eric Dumazet <[email protected]> Date: Wed, 01 Mar 2017 08:39:49 -0800
> From: Eric Dumazet <[email protected]> > > SYN processing really was meant to be handled from BH. > > When I got rid of BH blocking while processing socket backlog > in commit 5413d1babe8f ("net: do not block BH while processing socket > backlog"), I forgot that a malicious user could transition to TCP_LISTEN > from a state that allowed (SYN) packets to be parked in the socket > backlog while socket is owned by the thread doing the listen() call. > > Sure enough syzkaller found this and reported the bug ;) ... > Fixes: 5413d1babe8f ("net: do not block BH while processing socket backlog") > Signed-off-by: Eric Dumazet <[email protected]> > Reported-by: Andrey Konovalov <[email protected]> Applied and queued up for -stable, thanks.
