[PATCH net 0/3] net: fixes for requests completing on a socket that no longer listens

[Hyunwoo Kim <imv4bel@gmail.com>]

connect(AF_UNSPEC) followed by connect() turns a listener into an active
session, and IPV6_ADDRFORM on top of that turns it into an AF_INET socket.
The requests that pointed at that listener are still in the ehash, and
tcp_check_req() completes them without holding the listener lock.

All three patches fix a consequence of the same thing, a request
completing against a socket that is no longer a listener. The request is
released twice, or the child is allocated with the wrong size, or the
child inherits state the parent picked up in the meantime.

Hyunwoo Kim (3):
  ipv6: fix request socket use-after-free after IPV6_ADDRFORM
  net: fix out-of-bounds write in sk_clone() racing with IPV6_ADDRFORM
  tcp: do not inherit out_of_order_queue from parent

 net/core/sock.c          | 2 +-
 net/ipv4/tcp_minisocks.c | 1 +
 net/ipv6/ipv6_sockglue.c | 4 ++++
 3 files changed, 6 insertions(+), 1 deletion(-)

-- 
2.43.0