lkml.org 
[lkml]   [2010]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[146/156] tcp: Fix tcp_make_synack()
    2.6.33-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Eric Dumazet <eric.dumazet@gmail.com>

    [ Upstream commit 28b2774a0d5852236dab77a4147b8b88548110f1 ]

    Commit 4957faad (TCPCT part 1g: Responder Cookie => Initiator), part
    of TCP_COOKIE_TRANSACTION implementation, forgot to correctly size
    synack skb in case user data must be included.

    Many thanks to Mika Pentillä for spotting this error.

    Reported-by: Penttillä Mika <mika.penttila@ixonos.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ---
    net/ipv4/tcp_output.c | 18 +++++++++---------
    1 file changed, 9 insertions(+), 9 deletions(-)

    --- a/net/ipv4/tcp_output.c
    +++ b/net/ipv4/tcp_output.c
    @@ -2393,13 +2393,17 @@ struct sk_buff *tcp_make_synack(struct s
    struct tcp_extend_values *xvp = tcp_xv(rvp);
    struct inet_request_sock *ireq = inet_rsk(req);
    struct tcp_sock *tp = tcp_sk(sk);
    + const struct tcp_cookie_values *cvp = tp->cookie_values;
    struct tcphdr *th;
    struct sk_buff *skb;
    struct tcp_md5sig_key *md5;
    int tcp_header_size;
    int mss;
    + int s_data_desired = 0;

    - skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
    + if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
    + s_data_desired = cvp->s_data_desired;
    + skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
    if (skb == NULL)
    return NULL;

    @@ -2454,16 +2458,12 @@ struct sk_buff *tcp_make_synack(struct s
    TCPCB_FLAG_SYN | TCPCB_FLAG_ACK);

    if (OPTION_COOKIE_EXTENSION & opts.options) {
    - const struct tcp_cookie_values *cvp = tp->cookie_values;
    -
    - if (cvp != NULL &&
    - cvp->s_data_constant &&
    - cvp->s_data_desired > 0) {
    - u8 *buf = skb_put(skb, cvp->s_data_desired);
    + if (s_data_desired) {
    + u8 *buf = skb_put(skb, s_data_desired);

    /* copy data directly from the listening socket. */
    - memcpy(buf, cvp->s_data_payload, cvp->s_data_desired);
    - TCP_SKB_CB(skb)->end_seq += cvp->s_data_desired;
    + memcpy(buf, cvp->s_data_payload, s_data_desired);
    + TCP_SKB_CB(skb)->end_seq += s_data_desired;
    }

    if (opts.hash_size > 0) {

    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2010-03-31 01:51    [W:2.196 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site