* [PATCH net] tcp: fix potential memory corruption
@ 2016-11-02 14:53 Eric Dumazet
2016-11-03 19:34 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Eric Dumazet @ 2016-11-02 14:53 UTC (permalink / raw)
To: David Miller; +Cc: netdev, Hans Westgaard Ry, Håkon Bugge
From: Eric Dumazet <edumazet@google.com>
Imagine initial value of max_skb_frags is 17, and last
skb in write queue has 15 frags.
Then max_skb_frags is lowered to 14 or smaller value.
tcp_sendmsg() will then be allowed to add additional page frags
and eventually go past MAX_SKB_FRAGS, overflowing struct
skb_shared_info.
Fixes: 5f74f82ea34c ("net:Add sysctl_max_skb_frags")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Hans Westgaard Ry <hans.westgaard.ry@oracle.com>
Cc: Håkon Bugge <haakon.bugge@oracle.com>
---
net/ipv4/tcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 3251fe71f39f..18238ef8135a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1241,7 +1241,7 @@ int tcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
if (!skb_can_coalesce(skb, i, pfrag->page,
pfrag->offset)) {
- if (i == sysctl_max_skb_frags || !sg) {
+ if (i >= sysctl_max_skb_frags || !sg) {
tcp_mark_push(tp, skb);
goto new_segment;
}
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] tcp: fix potential memory corruption
2016-11-02 14:53 [PATCH net] tcp: fix potential memory corruption Eric Dumazet
@ 2016-11-03 19:34 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2016-11-03 19:34 UTC (permalink / raw)
To: eric.dumazet; +Cc: netdev, hans.westgaard.ry, haakon.bugge
From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed, 02 Nov 2016 07:53:17 -0700
> From: Eric Dumazet <edumazet@google.com>
>
> Imagine initial value of max_skb_frags is 17, and last
> skb in write queue has 15 frags.
>
> Then max_skb_frags is lowered to 14 or smaller value.
>
> tcp_sendmsg() will then be allowed to add additional page frags
> and eventually go past MAX_SKB_FRAGS, overflowing struct
> skb_shared_info.
>
> Fixes: 5f74f82ea34c ("net:Add sysctl_max_skb_frags")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-11-03 19:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-11-02 14:53 [PATCH net] tcp: fix potential memory corruption Eric Dumazet
2016-11-03 19:34 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.