[TCP]: Make sure write_queue_from does not begin with NULL ptr (96a2d41a) · Commits · 戴 / test

NULL ptr can be returned from tcp_write_queue_head to cached_skb and then assigned to skb if packets_out was zero. Without this, system is vulnerable to a carefully crafted ACKs which obviously is remotely triggerable. Besides, there's very little that needs to be done in sacktag if there weren't any packets outstanding, just skipping the rest doesn't hurt. Signed-off-by:

Ilpo Jrvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/tcp_input.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -1269,6 +1269,9 @@ tcp_sacktag_write_queue(struct sock sk, struct sk_buff ack_skb, u32 prior_snd_
		if (before(TCP_SKB_CB(ack_skb)->ack_seq, prior_snd_una - tp->max_window))
		return 0;

		if (!tp->packets_out)
		goto out;

		/* SACK fastpath:
		* if the only SACK change is the increase of the end_seq of
		* the first block then only apply that SACK block
		@@ -1515,6 +1518,8 @@ tcp_sacktag_write_queue(struct sock sk, struct sk_buff ack_skb, u32 prior_snd_
		(!tp->frto_highmark \|\| after(tp->snd_una, tp->frto_highmark)))
		tcp_update_reordering(sk, tp->fackets_out - reord, 0);

		out:

		#if FASTRETRANS_DEBUG > 0
		BUG_TRAP((int)tp->sacked_out >= 0);
		BUG_TRAP((int)tp->lost_out >= 0);

Admin message