On Wed, Aug 15, 2018 at 01:11:21PM +0200, Greg Kroah-Hartman wrote:
On Wed, Aug 15, 2018 at 11:58:46AM +0200, Takashi Iwai wrote:
The 4.4.y stable backport dc6ae4dffd65 for the upstream commit 3d4bf93ac120 ("tcp: detect malicious patterns in tcp_collapse_ofo_queue()") missed a line that enlarges the range_truesize value, which broke the whole check.
Fixes: dc6ae4dffd65 ("tcp: detect malicious patterns in tcp_collapse_ofo_queue()") Signed-off-by: Takashi Iwai tiwai@suse.de
Greg, this is a fix-up specific to 4.4.y stable backport that had a slightly different form from upstream fix. I haven't looked at the older trees, but 4.9.y and later took the upstream fix as is, so this patch isn't needed for them.
The patch hasn't been tested with the real test case, though; let me know if the current code is intended. Thanks!
Hm, I did the initial backport, and then Eric showed what I got wrong and fixed that up, so being still wrong is not inconceivable at all :)
Takashi's follow-up patch is what makes the backport work the same way as the original mainline commit 3d4bf93ac120. Without it, range_truesize will be always equal to truesize of first packet in a contiguous range so that the condition
range_truesize != head->truesize
will be always false (and there would be no point having range_truesize variable at all).
Michal Kubecek