summaryrefslogtreecommitdiff
path: root/samples
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2017-04-26 17:15:40 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-05-14 14:00:20 +0200
commitf3235cbd5be15aa084d5561c2eb8492ed68cd7e5 (patch)
treec661126b93152af4b9fe70d2c04e1f143acbcdd3 /samples
parent3b0129d4111e53927c2bc3c6b78a2b12ad71268b (diff)
tcp: do not underestimate skb->truesize in tcp_trim_head()
[ Upstream commit 7162fb242cb8322beb558828fd26b33c3e9fc805 ] Andrey found a way to trigger the WARN_ON_ONCE(delta < len) in skb_try_coalesce() using syzkaller and a filter attached to a TCP socket over loopback interface. I believe one issue with looped skbs is that tcp_trim_head() can end up producing skb with under estimated truesize. It hardly matters for normal conditions, since packets sent over loopback are never truncated. Bytes trimmed from skb->head should not change skb truesize, since skb->head is not reallocated. Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Tested-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'samples')
0 files changed, 0 insertions, 0 deletions