Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96a2d41a authored by Ilpo Jrvinen's avatar Ilpo Jrvinen Committed by David S. Miller
Browse files

[TCP]: Make sure write_queue_from does not begin with NULL ptr 



NULL ptr can be returned from tcp_write_queue_head to cached_skb
and then assigned to skb if packets_out was zero. Without this,
system is vulnerable to a carefully crafted ACKs which obviously
is remotely triggerable.

Besides, there's very little that needs to be done in sacktag
if there weren't any packets outstanding, just skipping the rest
doesn't hurt.

Signed-off-by: default avatarIlpo Jrvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fb93134d

net/ipv4/tcp_input.c

+5 −0
Original line number Diff line number Diff line
@@ -1269,6 +1269,9 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_ 
	if (before(TCP_SKB_CB(ack_skb)->ack_seq, prior_snd_una - tp->max_window))

		return 0;



	if (!tp->packets_out)

		goto out;



	/* SACK fastpath:

	 * if the only SACK change is the increase of the end_seq of

	 * the first block then only apply that SACK block
@@ -1515,6 +1518,8 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_ 
	    (!tp->frto_highmark || after(tp->snd_una, tp->frto_highmark)))

		tcp_update_reordering(sk, tp->fackets_out - reord, 0);



out:



#if FASTRETRANS_DEBUG > 0

	BUG_TRAP((int)tp->sacked_out >= 0);

	BUG_TRAP((int)tp->lost_out >= 0);