Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64022d0b authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

tcp: fix crashes in do_tcp_sendpages() 



Recent network changes allowed high order pages being used
for skb fragments.

This uncovered a bug in do_tcp_sendpages() which was assuming its caller
provided an array of order-0 page pointers.

We only have to deal with a single page in this function, and its order
is irrelevant.

Reported-by: default avatarWilly Tarreau <w@1wt.eu>
Tested-by: default avatarWilly Tarreau <w@1wt.eu>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9f8933e9

net/ipv4/tcp.c

+6 −9
Original line number Diff line number Diff line
@@ -830,8 +830,8 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags) 
	return mss_now;

}



static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffset,

			 size_t psize, int flags)

static ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,

				size_t size, int flags)

{

	struct tcp_sock *tp = tcp_sk(sk);

	int mss_now, size_goal;
@@ -858,12 +858,9 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse 
	if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))

		goto out_err;



	while (psize > 0) {

	while (size > 0) {

		struct sk_buff *skb = tcp_write_queue_tail(sk);

		struct page *page = pages[poffset / PAGE_SIZE];

		int copy, i;

		int offset = poffset % PAGE_SIZE;

		int size = min_t(size_t, psize, PAGE_SIZE - offset);

		bool can_coalesce;



		if (!tcp_send_head(sk) || (copy = size_goal - skb->len) <= 0) {
@@ -912,8 +909,8 @@ new_segment: 
			TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH;



		copied += copy;

		poffset += copy;

		if (!(psize -= copy))

		offset += copy;

		if (!(size -= copy))

			goto out;



		if (skb->len < size_goal || (flags & MSG_OOB))
@@ -960,7 +957,7 @@ int tcp_sendpage(struct sock *sk, struct page *page, int offset, 
					flags);



	lock_sock(sk);

	res = do_tcp_sendpages(sk, &page, offset, size, flags);

	res = do_tcp_sendpages(sk, page, offset, size, flags);

	release_sock(sk);

	return res;

}