https://github.com/torvalds/linux
Revision 7162fb242cb8322beb558828fd26b33c3e9fc805 authored by Eric Dumazet on 27 April 2017, 00:15:40 UTC, committed by David S. Miller on 28 April 2017, 20:05:22 UTC
Andrey found a way to trigger the WARN_ON_ONCE(delta < len) in
skb_try_coalesce() using syzkaller and a filter attached to a TCP
socket over loopback interface.

I believe one issue with looped skbs is that tcp_trim_head() can end up
producing skb with under estimated truesize.

It hardly matters for normal conditions, since packets sent over
loopback are never truncated.

Bytes trimmed from skb->head should not change skb truesize, since
skb->head is not reallocated.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 19cdead
History
Tip revision: 7162fb242cb8322beb558828fd26b33c3e9fc805 authored by Eric Dumazet on 27 April 2017, 00:15:40 UTC
tcp: do not underestimate skb->truesize in tcp_trim_head()
Tip revision: 7162fb2
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.3 KB
.mailmap -rw-r--r-- 7.9 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 96.0 KB
Kbuild -rw-r--r-- 2.8 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 389.8 KB
Makefile -rw-r--r-- 57.8 KB
README -rw-r--r-- 722 bytes

README

back to top