lkml.org 
[lkml]   [2018]   [Aug]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 02/13] tcp: Fix missing range_truesize enlargement in the backport
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Takashi Iwai <tiwai@suse.de>

    The 4.4.y stable backport dc6ae4dffd65 for the upstream commit
    3d4bf93ac120 ("tcp: detect malicious patterns in
    tcp_collapse_ofo_queue()") missed a line that enlarges the
    range_truesize value, which broke the whole check.

    Fixes: dc6ae4dffd65 ("tcp: detect malicious patterns in tcp_collapse_ofo_queue()")
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Cc: Michal Kubecek <mkubecek@suse.cz>
    ---

    Greg, this is a fix-up specific to 4.4.y stable backport that had a
    slightly different form from upstream fix. I haven't looked at the
    older trees, but 4.9.y and later took the upstream fix as is, so this
    patch isn't needed for them.

    The patch hasn't been tested with the real test case, though; let me
    know if the current code is intended. Thanks!


    net/ipv4/tcp_input.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -4835,6 +4835,7 @@ static void tcp_collapse_ofo_queue(struc
    end = TCP_SKB_CB(skb)->end_seq;
    range_truesize = skb->truesize;
    } else {
    + range_truesize += skb->truesize;
    if (before(TCP_SKB_CB(skb)->seq, start))
    start = TCP_SKB_CB(skb)->seq;
    if (after(TCP_SKB_CB(skb)->end_seq, end))

    \
     
     \ /
      Last update: 2018-08-16 20:57    [W:4.295 / U:0.372 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site