eec8575a88071dec97ad5c6e2 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Sun, 5 Feb 2017 20:23:22 -0800
Subject: ipv6: tcp: add a missing tcp_v6_restore_cb()

Dmitry reported use-after-free in ip6_datagram_recv_specific_ctl()

A similar bug was fixed in commit 8ce48623f0cf ("ipv6: tcp: restore
IP6CB for pktoptions skbs"), but I missed another spot.

tcp_v6_syn_recv_sock() can indeed set np->pktoptions from ireq->pktopts

Fixes: 971f10eca186 ("tcp: better TCP_SKB_CB layout to reduce cache line misses")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 net/ipv6/tcp_ipv6.c | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

(limited to 'net/ipv6/tcp_ipv6.c')

dex</a> : <a href='/cgit.cgi/linux/net-next.git/'>net-next.git</a></td><td class='form'><form method='get'>
<input type='hidden' name='id' value='4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'/><select name='h' onchange='this.form.submit();'>
<option value='emaclite-cleanup'>emaclite-cleanup</option>
<option value='master'>master</option>
<option value='nds-private-remove' selected='selected'>nds-private-remove</option>
<option value='packet-loop-back'>packet-loop-back</option>
<option value='packet-rx-pump-back'>packet-rx-pump-back</option>
</select> <input type='submit' value='switch'/></form></td></tr>
<tr><td class='sub'>net-next plumbings</td><td class='sub right'>Tobias Klauser</td></tr></table>
<table class='tabs'><tr><td>
<a href='/cgit.cgi/linux/net-next.git/?h=nds-private-remove'>summary</a><a href='/cgit.cgi/linux/net-next.git/refs/?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'>refs</a><a class='active' href='/cgit.cgi/linux/net-next.git/log/sound/isa/cs423x?h=nds-private-remove'>log</a><a href='/cgit.cgi/linux/net-next.git/tree/sound/isa/cs423x?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'>tree</a><a href='/cgit.cgi/linux/net-next.git/commit/sound/isa/cs423x?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'>commit</a><a href='/cgit.cgi/linux/net-next.git/diff/sound/isa/cs423x?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'>diff</a></td><td class='form'><form class='right' method='get' action='/cgit.cgi/linux/net-next.git/log/sound/isa/cs423x'>
<input type='hidden' name='h' value='nds-private-remove'/><input type='hidden' name='id' value='4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/cgit.cgi/linux/net-next.git/log/?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'>root</a>/<a href='/cgit.cgi/linux/net-next.git/log/sound?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'>sound</a>/<a href='/cgit.cgi/linux/net-next.git/log/sound/isa?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'>isa</a>/<a href='/cgit.cgi/linux/net-next.git/log/sound/isa/cs423x?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f'>cs423x</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/cgit.cgi/linux/net-next.git/log/sound/isa/cs423x?h=nds-private-remove&amp;id=4993b39ab04b083ff6ee1147e7e7f120feb6bf7f&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>