{"push_id":1773256406,"size":1,"distinct_size":1,"ref":"refs/heads/cm-14.1","head":"05a27f51b0fa89dccd52d7fa58f16775334cb792","before":"3738b005bb0da08a86d0c4420f8dca32541fa239","commits":[{"sha":"05a27f51b0fa89dccd52d7fa58f16775334cb792","author":{"name":"Andrey Konovalov","email":"acba6f9b010367f452595b80d6e1782629aa36cc@google.com"},"message":"dccp: fix freeing skb too early for IPV6_RECVPKTINFO\n\nIn the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet\nis forcibly freed via __kfree_skb in dccp_rcv_state_process if\ndccp_v6_conn_request successfully returns.\n\nHowever, if IPV6_RECVPKTINFO is set on a socket, the address of the skb\nis saved to ireq->pktopts and the ref count for skb is incremented in\ndccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed\nin dccp_rcv_state_process.\n\nFix by calling consume_skb instead of doing goto discard and therefore\ncalling __kfree_skb.\n\nSimilar fixes for TCP:\n\nfb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed.\n0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now\nsimply consumed\n\nChange-Id: I058761fd175b65f8c01281d1c776818905a92870\nSigned-off-by: Andrey Konovalov <andreyknvl@google.com>\nAcked-by: Eric Dumazet <edumazet@google.com>\nSigned-off-by: David S. Miller <davem@davemloft.net>","distinct":true,"url":"https://api.github.com/repos/LineageOS/android_kernel_bq_msm8937/commits/05a27f51b0fa89dccd52d7fa58f16775334cb792"}]}
{"actor":{"display_login":"lineageos-gerrit"}}