diff options
| author | Aparna Balasubramanian <aparnab@ti.com> | 2021-04-28 08:51:55 -0500 |
|---|---|---|
| committer | Aparna Balasubramanian <aparnab@ti.com> | 2021-04-28 08:51:55 -0500 |
| commit | 8b16abca7ed2e69ada253b4c63a9b99bb9133431 (patch) | |
| tree | 10ab37e4ed1861d32fbc538e9dd713e173345923 /net/ipv4/tcp.c | |
| parent | bdfd5b0c1ee5617c9a94bacad0d818920d95b486 (diff) | |
| parent | 1e798745fa8ef91ffe4fd38d443f9d44b59e3cb3 (diff) | |
Merge tag 'v5.10.30' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux into ti-linux-5.10.y
This is the 5.10.30 stable release
* tag 'v5.10.30' of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux: (1106 commits)
Linux 5.10.30
Revert "net: sched: bump refcount for new action in ACT replace mode"
net: ieee802154: stop dump llsec params for monitors
net: ieee802154: forbid monitor for del llsec seclevel
net: ieee802154: forbid monitor for set llsec params
net: ieee802154: fix nl802154 del llsec devkey
net: ieee802154: fix nl802154 add llsec key
net: ieee802154: fix nl802154 del llsec dev
net: ieee802154: fix nl802154 del llsec key
net: ieee802154: nl-mac: fix check on panid
net: mac802154: Fix general protection fault
drivers: net: fix memory leak in peak_usb_create_dev
drivers: net: fix memory leak in atusb_probe
net: tun: set tun->dev->addr_len during TUNSETLINK processing
cfg80211: remove WARN_ON() in cfg80211_sme_connect
gpiolib: Read "gpio-line-names" from a firmware node
net: sched: bump refcount for new action in ACT replace mode
dt-bindings: net: ethernet-controller: fix typo in NVMEM
lockdep: Address clang -Wformat warning printing for %hd
clk: socfpga: fix iomem pointer cast on 64-bit
...
Signed-off-by: Aparna Balasubramanian <aparnab@ti.com>
Diffstat (limited to 'net/ipv4/tcp.c')
| -rw-r--r-- | net/ipv4/tcp.c | 26 |
1 files changed, 17 insertions, 9 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 41d03683b13d..2384ac048bea 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3164,16 +3164,23 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, break; case TCP_QUEUE_SEQ: - if (sk->sk_state != TCP_CLOSE) + if (sk->sk_state != TCP_CLOSE) { err = -EPERM; - else if (tp->repair_queue == TCP_SEND_QUEUE) - WRITE_ONCE(tp->write_seq, val); - else if (tp->repair_queue == TCP_RECV_QUEUE) { - WRITE_ONCE(tp->rcv_nxt, val); - WRITE_ONCE(tp->copied_seq, val); - } - else + } else if (tp->repair_queue == TCP_SEND_QUEUE) { + if (!tcp_rtx_queue_empty(sk)) + err = -EPERM; + else + WRITE_ONCE(tp->write_seq, val); + } else if (tp->repair_queue == TCP_RECV_QUEUE) { + if (tp->rcv_nxt != tp->copied_seq) { + err = -EPERM; + } else { + WRITE_ONCE(tp->rcv_nxt, val); + WRITE_ONCE(tp->copied_seq, val); + } + } else { err = -EINVAL; + } break; case TCP_REPAIR_OPTIONS: @@ -3829,7 +3836,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level, if (get_user(len, optlen)) return -EFAULT; - if (len < offsetofend(struct tcp_zerocopy_receive, length)) + if (len < 0 || + len < offsetofend(struct tcp_zerocopy_receive, length)) return -EINVAL; if (len > sizeof(zc)) { len = sizeof(zc); |