mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-12-30 01:46:30 -05:00
46 lines
1.4 KiB
Diff
46 lines
1.4 KiB
Diff
|
From ccf7abb93af09ad0868ae9033d1ca8108bdaec82 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Eric Dumazet <edumazet@google.com>
|
||
|
|
Date: Fri, 3 Feb 2017 14:59:38 -0800
|
||
|
|
Subject: tcp: avoid infinite loop in tcp_splice_read()
|
||
|
|
|
||
|
|
Splicing from TCP socket is vulnerable when a packet with URG flag is
|
||
|
|
received and stored into receive queue.
|
||
|
|
|
||
|
|
__tcp_splice_read() returns 0, and sk_wait_data() immediately
|
||
|
|
returns since there is the problematic skb in queue.
|
||
|
|
|
||
|
|
This is a nice way to burn cpu (aka infinite loop) and trigger
|
||
|
|
soft lockups.
|
||
|
|
|
||
|
|
Again, this gem was found by syzkaller tool.
|
||
|
|
|
||
|
|
Fixes: 9c55e01c0cc8 ("[TCP]: Splice receive support.")
|
||
|
|
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||
|
|
Reported-by: Dmitry Vyukov <dvyukov@google.com>
|
||
|
|
Cc: Willy Tarreau <w@1wt.eu>
|
||
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||
|
|
---
|
||
|
|
net/ipv4/tcp.c | 6 ++++++
|
||
|
|
1 file changed, 6 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
|
||
|
|
index 4a04496..0efb4c7 100644
|
||
|
|
--- a/net/ipv4/tcp.c
|
||
|
|
+++ b/net/ipv4/tcp.c
|
||
|
|
@@ -770,6 +770,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
|
||
|
|
ret = -EAGAIN;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
+ /* if __tcp_splice_read() got nothing while we have
|
||
|
|
+ * an skb in receive queue, we do not want to loop.
|
||
|
|
+ * This might happen with URG data.
|
||
|
|
+ */
|
||
|
|
+ if (!skb_queue_empty(&sk->sk_receive_queue))
|
||
|
|
+ break;
|
||
|
|
sk_wait_data(sk, &timeo, NULL);
|
||
|
|
if (signal_pending(current)) {
|
||
|
|
ret = sock_intr_errno(timeo);
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|