Merge "tcp: detect malicious patterns in tcp_collapse_ofo_queue()" (ea1dbf8a) · Commits · e / devices / android_kernel_fairphone_FP3

net/ipv4/tcp_input.c

+13 −2

Original line number	Diff line number	Diff line
		@@ -4909,6 +4909,7 @@ tcp_collapse(struct sock sk, struct sk_buff_head list, struct rb_root *root,
		static void tcp_collapse_ofo_queue(struct sock *sk)
		{
		struct tcp_sock *tp = tcp_sk(sk);
		u32 range_truesize, sum_tiny = 0;
		struct sk_buff skb, head;
		struct rb_node *p;
		u32 start, end;
		@@ -4927,6 +4928,7 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
		}
		start = TCP_SKB_CB(skb)->seq;
		end = TCP_SKB_CB(skb)->end_seq;
		range_truesize = skb->truesize;

		for (head = skb;;) {
		skb = tcp_skb_next(skb, NULL);
		@@ -4937,11 +4939,20 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
		if (!skb \|\|
		after(TCP_SKB_CB(skb)->seq, end) \|\|
		before(TCP_SKB_CB(skb)->end_seq, start)) {
		/* Do not attempt collapsing tiny skbs */
		if (range_truesize != head->truesize \|\|
		end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) {
		tcp_collapse(sk, NULL, &tp->out_of_order_queue,
		head, skb, start, end);
		} else {
		sum_tiny += range_truesize;
		if (sum_tiny > sk->sk_rcvbuf >> 3)
		return;
		}
		goto new_range;
		}

		range_truesize += skb->truesize;
		if (unlikely(before(TCP_SKB_CB(skb)->seq, start)))
		start = TCP_SKB_CB(skb)->seq;
		if (after(TCP_SKB_CB(skb)->end_seq, end))