aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2019-12-05 10:10:15 -0800
committerPaul Gortmaker <paul.gortmaker@windriver.com>2020-01-31 16:51:10 -0500
commitf8089e38f2866dad5699845c7de54f3085c4eafd (patch)
treea01e4f278ef3c3749ee33cce086caacd341f77d9
parentc9b8428b8b429bdf9bd39cb191eb23a86ba1c825 (diff)
downloadlinux-yocto-f8089e38f2866dad5699845c7de54f3085c4eafd.tar.gz
linux-yocto-f8089e38f2866dad5699845c7de54f3085c4eafd.tar.bz2
linux-yocto-f8089e38f2866dad5699845c7de54f3085c4eafd.zip
tcp: md5: fix potential overestimation of TCP option space
commit 9424e2e7ad93ffffa88f882c9bc5023570904b55 upstream. Back in 2008, Adam Langley fixed the corner case of packets for flows having all of the following options : MD5 TS SACK Since MD5 needs 20 bytes, and TS needs 12 bytes, no sack block can be cooked from the remaining 8 bytes. tcp_established_options() correctly sets opts->num_sack_blocks to zero, but returns 36 instead of 32. This means TCP cooks packets with 4 extra bytes at the end of options, containing unitialized bytes. Fixes: 33ad798c924b ("tcp: options clean up") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Acked-by: Neal Cardwell <ncardwell@google.com> Acked-by: Soheil Hassas Yeganeh <soheil@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r--net/ipv4/tcp_output.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 37c2f1204c1a..74aa691fd0ae 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -755,8 +755,9 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
min_t(unsigned int, eff_sacks,
(remaining - TCPOLEN_SACK_BASE_ALIGNED) /
TCPOLEN_SACK_PERBLOCK);
- size += TCPOLEN_SACK_BASE_ALIGNED +
- opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK;
+ if (likely(opts->num_sack_blocks))
+ size += TCPOLEN_SACK_BASE_ALIGNED +
+ opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK;
}
return size;