Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 690e99c4 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

tcp: tcp_sendmsg() wrong access to sk_route_caps 



Now sk_route_caps is u64, its dangerous to use an integer to store
result of an AND operator. It wont work if NETIF_F_SG is moved on the
upper part of u64.

Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
CC: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8b7ff200

net/ipv4/tcp.c

+4 −4
Original line number Diff line number Diff line
@@ -891,7 +891,7 @@ EXPORT_SYMBOL(tcp_sendpage); 
#define TCP_PAGE(sk)	(sk->sk_sndmsg_page)

#define TCP_OFF(sk)	(sk->sk_sndmsg_off)



static inline int select_size(const struct sock *sk, int sg)

static inline int select_size(const struct sock *sk, bool sg)

{

	const struct tcp_sock *tp = tcp_sk(sk);

	int tmp = tp->mss_cache;
@@ -917,9 +917,9 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, 
	struct iovec *iov;

	struct tcp_sock *tp = tcp_sk(sk);

	struct sk_buff *skb;

	int iovlen, flags;

	int iovlen, flags, err, copied;

	int mss_now, size_goal;

	int sg, err, copied;

	bool sg;

	long timeo;



	lock_sock(sk);
@@ -946,7 +946,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, 
	if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))

		goto out_err;



	sg = sk->sk_route_caps & NETIF_F_SG;

	sg = !!(sk->sk_route_caps & NETIF_F_SG);



	while (--iovlen >= 0) {

		size_t seglen = iov->iov_len;