Commit 3c961afe authored May 10, 2012 by Pavel Emelyanov Committed by David S. Miller May 10, 2012

tcp: Schedule rmem for rcvq repair send



As noted by Eric, no checks are performed on the data size we're
putting in the read queue during repair. Thus, validate the given
data size with the common rmem management routine.

Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 292e8d8c

net/ipv4/tcp_input.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -4769,6 +4769,9 @@ int tcp_send_rcvq(struct sock sk, struct msghdr msg, size_t size)
		struct tcphdr *th;
		bool fragstolen;

		if (tcp_try_rmem_schedule(sk, size + sizeof(*th)))
		goto err;

		skb = alloc_skb(size + sizeof(*th), sk->sk_allocation);
		if (!skb)
		goto err;