* [PATCH] net: Fix oops from tcp_collapse() when using splice()
@ 2010-03-30 20:45 Steven J. Magnani
2010-03-30 20:47 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Steven J. Magnani @ 2010-03-30 20:45 UTC (permalink / raw)
To: netdev
Cc: David S. Miller, Alexey Kuznetsov, Pekka Savola (ipv6),
James Morris, Hideaki YOSHIFUJI, Patrick McHardy, linux-kernel,
monstr, Karl Hiramoto, Steven J. Magnani
tcp_read_sock() can have a eat skbs without immediately advancing copied_seq.
This can cause a panic in tcp_collapse() if it is called as a result
of the recv_actor dropping the socket lock.
A userspace program that splices data from a socket to either another
socket or to a file can trigger this bug.
Signed-off-by: Steven J. Magnani <steve@digidescorp.com>
---
diff -uprN a/net/ipv4/tcp.c b/net/ipv4/tcp.c
--- a/net/ipv4/tcp.c 2010-03-30 15:25:55.000000000 -0500
+++ b/net/ipv4/tcp.c 2010-03-30 15:27:49.000000000 -0500
@@ -1335,6 +1335,7 @@ int tcp_read_sock(struct sock *sk, read_
sk_eat_skb(sk, skb, 0);
if (!desc->count)
break;
+ tp->copied_seq = seq;
}
tp->copied_seq = seq;
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] net: Fix oops from tcp_collapse() when using splice()
2010-03-30 20:45 [PATCH] net: Fix oops from tcp_collapse() when using splice() Steven J. Magnani
@ 2010-03-30 20:47 ` David Miller
2010-03-30 20:56 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2010-03-30 20:47 UTC (permalink / raw)
To: steve
Cc: netdev, kuznet, pekkas, jmorris, yoshfuji, kaber, linux-kernel,
monstr, karl
From: "Steven J. Magnani" <steve@digidescorp.com>
Date: Tue, 30 Mar 2010 15:45:13 -0500
> tcp_read_sock() can have a eat skbs without immediately advancing copied_seq.
> This can cause a panic in tcp_collapse() if it is called as a result
> of the recv_actor dropping the socket lock.
>
> A userspace program that splices data from a socket to either another
> socket or to a file can trigger this bug.
>
> Signed-off-by: Steven J. Magnani <steve@digidescorp.com>
Thanks for fixing this I'll look at your patch more closely
right now.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] net: Fix oops from tcp_collapse() when using splice()
2010-03-30 20:47 ` David Miller
@ 2010-03-30 20:56 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2010-03-30 20:56 UTC (permalink / raw)
To: steve
Cc: netdev, kuznet, pekkas, jmorris, yoshfuji, kaber, linux-kernel,
monstr, karl
From: David Miller <davem@davemloft.net>
Date: Tue, 30 Mar 2010 13:47:41 -0700 (PDT)
> From: "Steven J. Magnani" <steve@digidescorp.com>
> Date: Tue, 30 Mar 2010 15:45:13 -0500
>
>> tcp_read_sock() can have a eat skbs without immediately advancing copied_seq.
>> This can cause a panic in tcp_collapse() if it is called as a result
>> of the recv_actor dropping the socket lock.
>>
>> A userspace program that splices data from a socket to either another
>> socket or to a file can trigger this bug.
>>
>> Signed-off-by: Steven J. Magnani <steve@digidescorp.com>
>
> Thanks for fixing this I'll look at your patch more closely
> right now.
Patch applied, thanks Steven!
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-03-30 20:56 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-03-30 20:45 [PATCH] net: Fix oops from tcp_collapse() when using splice() Steven J. Magnani
2010-03-30 20:47 ` David Miller
2010-03-30 20:56 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).