net: use sock_gen_put() when sk_state is TCP_TIME_WAIT

In the Linux kernel, the following vulnerability has been resolved:

net: use sock_gen_put() when sk_state is TCP_TIME_WAIT

It is possible for a pointer of type struct inet_timewait_sock to be

returned from the functions __inet_lookup_established() and

__inet6_lookup_established(). This can cause a crash when the

returned pointer is of type struct inet_timewait_sock and

sock_put() is called on it. The following is a crash call stack that

shows sk->sk_wmem_alloc being accessed in sk_free() during the call to

sock_put() on a struct inet_timewait_sock pointer. To avoid this issue,

use sock_gen_put() instead of sock_put() when sk->sk_state

is TCP_TIME_WAIT.

mrdump.ko ipanic() + 120

vmlinux notifier_call_chain(nr_to_call=-1, nr_calls=0) + 132

vmlinux atomic_notifier_call_chain(val=0) + 56

vmlinux panic() + 344

vmlinux add_taint() + 164

vmlinux end_report() + 136

vmlinux kasan_report(size=0) + 236

vmlinux report_tag_fault() + 16

vmlinux do_tag_recovery() + 16

vmlinux __do_kernel_fault() + 88

vmlinux do_bad_area() + 28

vmlinux do_tag_check_fault() + 60

vmlinux do_mem_abort() + 80

vmlinux el1_abort() + 56

vmlinux el1h_64_sync_handler() + 124

vmlinux > 0xFFFFFFC080011294()

vmlinux __lse_atomic_fetch_add_release(v=0xF2FFFF82A896087C)

vmlinux __lse_atomic_fetch_sub_release(v=0xF2FFFF82A896087C)

vmlinux arch_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C)

+ 8

vmlinux raw_atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C)

+ 8

vmlinux atomic_fetch_sub_release(i=1, v=0xF2FFFF82A896087C) + 8

vmlinux __refcount_sub_and_test(i=1, r=0xF2FFFF82A896087C,

oldp=0) + 8

vmlinux __refcount_dec_and_test(r=0xF2FFFF82A896087C, oldp=0) + 8

vmlinux refcount_dec_and_test(r=0xF2FFFF82A896087C) + 8

vmlinux sk_free(sk=0xF2FFFF82A8960700) + 28

vmlinux sock_put() + 48

vmlinux tcp6_check_fraglist_gro() + 236

vmlinux tcp6_gro_receive() + 624

vmlinux ipv6_gro_receive() + 912

vmlinux dev_gro_receive() + 1116

vmlinux napi_gro_receive() + 196

ccmni.ko ccmni_rx_callback() + 208

ccmni.ko ccmni_queue_recv_skb() + 388

ccci_dpmaif.ko dpmaif_rxq_push_thread() + 1088

vmlinux kthread() + 268

vmlinux 0xFFFFFFC08001F30C()