netdev - Re: Bug in computing data_len in tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 1 Dec 2011 14:18:17 -0800
From:	Vijay Subramanian <subramanian.vijay@...il.com>
To:	Eric Dumazet <eric.dumazet@...il.com>
Cc:	Tom Herbert <therbert@...gle.com>,
	Linux Netdev List <netdev@...r.kernel.org>,
	David Miller <davem@...emloft.net>
Subject: Re: Bug in computing data_len in tcp_sendmsg?

>
> Or the "bug" was to assume that skb was headless.
> It was true until recently.
>
> We recently added commit f07d960df33c5aef
> (tcp: avoid frag allocation for small frames)
>
> to avoid page allocation for small frames.
>
> So now, skb can contain in head part of tcp data.
>
>

Hi,
I am looking at tcp_mtu_probe() and was wondering if this commit also
impacts this function. Once the data are copied from skbs in the write
queue to the probe skb, copied data are cleared from the original skbs
in the write queue.

It looks like the code assumes that the original skb will have data
either in linear part or in paged part.  The call to
__pskb_trim_head(skb, copy) for example does not clear linear part.

Can someone more familiar with the code take a look? Apologies if I
have read this wrong.

Regards
Vijay Subramanian
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html