sock_put() on a TIMEWAIT socket

Dave,

Caught an instance of sock_put() being used instead of tcp_tw_put().

If the refcnt goes to 0, tcp_tw_put() will release a tcp_tw_bucket back into the tcp timewait cache, whereas the sock_put() decrement will release a sock struct back into the sk cache. Not sure how the slab caches handle this, but tw is a smaller structure and the next caller who gets this tw pointer thinking it's a sock could potentially write past memory that it should (?).

Patch applies to 2.4.25.

thanks,
Nivedita

diff -urN linux-2.4.25/net/ipv4/tcp_ipv4.c linux-2.4.25mc/net/ipv4/tcp_ipv4.c
@@ -1804,7 +1804,8 @@
 do_time_wait:
 	if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 		TCP_INC_STATS_BH(TcpInErrs);
-		goto discard_and_relse;
+		tcp_tw_put((struct tcp_tw_bucket *) sk);
+		goto discard_it;
 	}
 	switch(tcp_timewait_state_process((struct tcp_tw_bucket *)sk,
 					  skb, th, skb->len)) {