| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 25 Apr 2011 22:05:24 +0200 From: Willy Tarreau <w@....eu> To: linux-kernel@...r.kernel.org, stable@...nel.org, stable-review@...nel.org Cc: "Steven J. Magnani" <steve@...idescorp.com>, "David S. Miller" <davem@...emloft.net> Subject: [PATCH 172/173] net: Fix oops from tcp_collapse() when using splice() 2.6.27.59-stable review patch. If anyone has any objections, please let us know. ------------------ From: Steven J. Magnani <steve@...idescorp.com> commit baff42ab1494528907bf4d5870359e31711746ae upstream. tcp_read_sock() can have a eat skbs without immediately advancing copied_seq. This can cause a panic in tcp_collapse() if it is called as a result of the recv_actor dropping the socket lock. A userspace program that splices data from a socket to either another socket or to a file can trigger this bug. Signed-off-by: Steven J. Magnani <steve@...idescorp.com> Signed-off-by: David S. Miller <davem@...emloft.net> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 6afb6d8..2c75f89 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1368,6 +1368,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, sk_eat_skb(sk, skb, 0); if (!desc->count) break; + tp->copied_seq = seq; } tp->copied_seq = seq; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists