tcp_fastopen_active_disable_ofo_check() is called from tcp_disconnect() or tcp_v4_destroy_sock(), so not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use sk_dst_dev_rcu(). Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Kuniyuki Iwashima --- Cc: Neal Cardwell --- net/ipv4/tcp_fastopen.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c index f1884f0c9e52..de849b8c87ef 100644 --- a/net/ipv4/tcp_fastopen.c +++ b/net/ipv4/tcp_fastopen.c @@ -560,7 +560,6 @@ void tcp_fastopen_active_disable_ofo_check(struct sock *sk) { struct tcp_sock *tp = tcp_sk(sk); struct net_device *dev; - struct dst_entry *dst; struct sk_buff *skb; if (!tp->syn_fastopen) @@ -576,11 +575,11 @@ void tcp_fastopen_active_disable_ofo_check(struct sock *sk) } } else if (tp->syn_fastopen_ch && atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times)) { - dst = sk_dst_get(sk); - dev = dst ? dst_dev(dst) : NULL; + rcu_read_lock(); + dev = sk_dst_dev_rcu(sk); if (!(dev && (dev->flags & IFF_LOOPBACK))) atomic_set(&sock_net(sk)->ipv4.tfo_active_disable_times, 0); - dst_release(dst); + rcu_read_unlock(); } } -- 2.51.0.384.g4c02a37b29-goog