[lkml]   [2007]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[patch 36/69] TCP: zero out rx_opt in tcp_disconnect()
    -stable review patch.  If anyone has any objections, please let us know.

    From: Srinivas Aji <>

    When the server drops its connection, NFS client reconnects using the
    same socket after disconnecting. If the new connection's SYN,ACK
    doesn't contain the TCP timestamp option and the old connection's did,
    tp->tcp_header_len is recomputed assuming no timestamp header but
    tp->rx_opt.tstamp_ok remains set. Then tcp_build_and_update_options()
    adds in a timestamp option past the end of the allocated TCP header,
    overwriting TCP data, or when the data is in skb_shinfo(skb)->frags[],
    overwriting skb_shinfo(skb) causing a crash soon after. (The issue was
    debugged from such a crash.)

    Similarly, wscale_ok and sack_ok also get set based on the SYN,ACK
    packet but not reset on disconnect, since they are zeroed out at
    initialization. The patch zeroes out the entire tp->rx_opt struct in
    tcp_disconnect() to avoid this sort of problem.

    Signed-off-by: Srinivas Aji <>
    Signed-off-by: David S. Miller <>
    Signed-off-by: Chris Wright <>

    net/ipv4/tcp.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- linux-
    +++ linux-
    @@ -1759,8 +1759,7 @@ int tcp_disconnect(struct sock *sk, int
    sk->sk_send_head = NULL;
    - tp->rx_opt.saw_tstamp = 0;
    - tcp_sack_reset(&tp->rx_opt);
    + memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));

    BUG_TRAP(!inet->num || icsk->icsk_bind_hash);
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-05-21 21:51    [W:0.020 / U:61.368 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site