• Dimitris Michailidis's avatar
    tcp: Fix length tcp_splice_data_recv passes to skb_splice_bits. · 9fa5fdf2
    Dimitris Michailidis authored
    tcp_splice_data_recv has two lengths to consider: the len parameter it
    gets from tcp_read_sock, which specifies the amount of data in the skb,
    and rd_desc->count, which is the amount of data the splice caller still
    wants.  Currently it passes just the latter to skb_splice_bits, which then
    splices min(rd_desc->count, skb->len - offset) bytes.
    
    Most of the time this is fine, except when the skb contains urgent data.
    In that case len goes only up to the urgent byte and is less than
    skb->len - offset.  By ignoring len tcp_splice_data_recv may a) splice
    data tcp_read_sock told it not to, b) return to tcp_read_sock a value > len.
    
    Now, tcp_read_sock doesn't handle used > len and leaves the socket in a
    bad state (both sk_receive_queue and copied_seq are bad at that point)
    resulting in duplicated data and corruption.
    
    Fix by passing min(rd_desc->count, len) to skb_splice_bits.
    Signed-off-by: default avatarDimitris Michailidis <dm@chelsio.com>
    Acked-by: default avatarEric Dumazet <dada1@cosmosbay.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    9fa5fdf2
tcp.c 74.8 KB