lkml.org 
[lkml]   [2009]   [Feb]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 37/48] tcp: Fix length tcp_splice_data_recv passes to skb_splice_bits.
    2.6.28-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Dimitris Michailidis <dm@chelsio.com>

    [ Upstream commit 9fa5fdf291c9b58b1cb8b4bb2a0ee57efa21d635 ]

    tcp_splice_data_recv has two lengths to consider: the len parameter it
    gets from tcp_read_sock, which specifies the amount of data in the skb,
    and rd_desc->count, which is the amount of data the splice caller still
    wants. Currently it passes just the latter to skb_splice_bits, which then
    splices min(rd_desc->count, skb->len - offset) bytes.

    Most of the time this is fine, except when the skb contains urgent data.
    In that case len goes only up to the urgent byte and is less than
    skb->len - offset. By ignoring len tcp_splice_data_recv may a) splice
    data tcp_read_sock told it not to, b) return to tcp_read_sock a value > len.

    Now, tcp_read_sock doesn't handle used > len and leaves the socket in a
    bad state (both sk_receive_queue and copied_seq are bad at that point)
    resulting in duplicated data and corruption.

    Fix by passing min(rd_desc->count, len) to skb_splice_bits.

    Signed-off-by: Dimitris Michailidis <dm@chelsio.com>
    Acked-by: Eric Dumazet <dada1@cosmosbay.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/ipv4/tcp.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/net/ipv4/tcp.c
    +++ b/net/ipv4/tcp.c
    @@ -522,7 +522,8 @@ static int tcp_splice_data_recv(read_des
    struct tcp_splice_state *tss = rd_desc->arg.data;
    int ret;

    - ret = skb_splice_bits(skb, offset, tss->pipe, rd_desc->count, tss->flags);
    + ret = skb_splice_bits(skb, offset, tss->pipe, min(rd_desc->count, len),
    + tss->flags);
    if (ret > 0)
    rd_desc->count -= ret;
    return ret;


    \
     
     \ /
      Last update: 2009-02-14 02:45    [W:0.021 / U:30.268 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site