summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorSteven J. Magnani <steve@digidescorp.com>2010-03-30 13:56:01 -0700
committerGreg Kroah-Hartman <gregkh@suse.de>2010-09-26 17:21:20 -0700
commit12fc5c218002041cf2d3be3a5fd26fad993c6fbc (patch)
tree9a975688bd122b5a302852518dd419cdff2c0909 /net
parentc9d740b86fee3c2be9eaf3d7728c15c0e03f4d83 (diff)
net: Fix oops from tcp_collapse() when using splice()
[ Upstream commit baff42ab1494528907bf4d5870359e31711746ae ] tcp_read_sock() can have a eat skbs without immediately advancing copied_seq. This can cause a panic in tcp_collapse() if it is called as a result of the recv_actor dropping the socket lock. A userspace program that splices data from a socket to either another socket or to a file can trigger this bug. Signed-off-by: Steven J. Magnani <steve@digidescorp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/tcp.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0df6fc0e8a53..108fad073194 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1335,6 +1335,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
sk_eat_skb(sk, skb, 0);
if (!desc->count)
break;
+ tp->copied_seq = seq;
}
tp->copied_seq = seq;