[PATCH 2.4] sock_put() on a TIMEWAIT socket

[Nivedita Singhvi <niv@xxxxxxxxxx>]

Dave,

Caught an instance of sock_put() being used instead of
tcp_tw_put().

If the refcnt goes to 0, tcp_tw_put() will release a
tcp_tw_bucket back into the tcp timewait cache, whereas
the sock_put() decrement will release a sock struct back
into the sk cache.  Not sure how the slab caches handle
this, but tw is a smaller structure and the next caller
who gets this tw pointer thinking it's a sock could
potentially write past memory that it should (?).

Patch applies to 2.4.25.

thanks,
Nivedita


diff -urN linux-2.4.25/net/ipv4/tcp_ipv4.c 
linux-2.4.25mc/net/ipv4/tcp_ipv4.c
--- linux-2.4.25/net/ipv4/tcp_ipv4.c    2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.25mc/net/ipv4/tcp_ipv4.c  2004-03-28 16:35:01.000000000 -0800
@@ -1804,7 +1804,8 @@
 do_time_wait:
        if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
                TCP_INC_STATS_BH(TcpInErrs);
-               goto discard_and_relse;
+               tcp_tw_put((struct tcp_tw_bucket *) sk);
+               goto discard_it;
        }
        switch(tcp_timewait_state_process((struct tcp_tw_bucket *)sk,
                                          skb, th, skb->len)) {