diff options
| author | Eric Dumazet <edumazet@google.com> | 2017-04-26 17:15:40 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-05-15 09:19:08 +0200 |
| commit | e8a9fdfe683e9120dba8c871e82c3c7788084162 (patch) | |
| tree | 0c706b67fbd0556e9591b8633287e4c88c30bed7 /net/ipv4/raw.c | |
| parent | f98b49b779692ba9e1a9bb6811e7c316819622c1 (diff) | |
tcp: do not underestimate skb->truesize in tcp_trim_head()
[ Upstream commit 7162fb242cb8322beb558828fd26b33c3e9fc805 ]
Andrey found a way to trigger the WARN_ON_ONCE(delta < len) in
skb_try_coalesce() using syzkaller and a filter attached to a TCP
socket over loopback interface.
I believe one issue with looped skbs is that tcp_trim_head() can end up
producing skb with under estimated truesize.
It hardly matters for normal conditions, since packets sent over
loopback are never truncated.
Bytes trimmed from skb->head should not change skb truesize, since
skb->head is not reallocated.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/ipv4/raw.c')
0 files changed, 0 insertions, 0 deletions