Searched hist:ac6e780070e30e4c35bd395acfe9191e6268bdd3 (Results 1 – 3 of 3) sorted by relevance
/linux/net/ipv6/ |
H A D | tcp_ipv6.c | diff ac6e780070e30e4c35bd395acfe9191e6268bdd3 Thu Nov 10 22:12:35 CET 2016 Eric Dumazet <edumazet@google.com> tcp: take care of truncations done by sk_filter()
With syzkaller help, Marco Grassi found a bug in TCP stack, crashing in tcp_collapse()
Root cause is that sk_filter() can truncate the incoming skb, but TCP stack was not really expecting this to happen. It probably was expecting a simple DROP or ACCEPT behavior.
We first need to make sure no part of TCP header could be removed. Then we need to adjust TCP_SKB_CB(skb)->end_seq
Many thanks to syzkaller team and Marco for giving us a reproducer.
Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Marco Grassi <marco.gra@gmail.com> Reported-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
|
/linux/include/net/ |
H A D | tcp.h | diff ac6e780070e30e4c35bd395acfe9191e6268bdd3 Thu Nov 10 22:12:35 CET 2016 Eric Dumazet <edumazet@google.com> tcp: take care of truncations done by sk_filter()
With syzkaller help, Marco Grassi found a bug in TCP stack, crashing in tcp_collapse()
Root cause is that sk_filter() can truncate the incoming skb, but TCP stack was not really expecting this to happen. It probably was expecting a simple DROP or ACCEPT behavior.
We first need to make sure no part of TCP header could be removed. Then we need to adjust TCP_SKB_CB(skb)->end_seq
Many thanks to syzkaller team and Marco for giving us a reproducer.
Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Marco Grassi <marco.gra@gmail.com> Reported-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
|
/linux/net/ipv4/ |
H A D | tcp_ipv4.c | diff ac6e780070e30e4c35bd395acfe9191e6268bdd3 Thu Nov 10 22:12:35 CET 2016 Eric Dumazet <edumazet@google.com> tcp: take care of truncations done by sk_filter()
With syzkaller help, Marco Grassi found a bug in TCP stack, crashing in tcp_collapse()
Root cause is that sk_filter() can truncate the incoming skb, but TCP stack was not really expecting this to happen. It probably was expecting a simple DROP or ACCEPT behavior.
We first need to make sure no part of TCP header could be removed. Then we need to adjust TCP_SKB_CB(skb)->end_seq
Many thanks to syzkaller team and Marco for giving us a reproducer.
Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Marco Grassi <marco.gra@gmail.com> Reported-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
|