Eric Dumazet 225a24ae97
tcp: take care of truncations done by sk_filter() ...
[ Upstream commit ac6e780070e30e4c35bd395acfe9191e6268bdd3 ]
With syzkaller help, Marco Grassi found a bug in TCP stack,
crashing in tcp_collapse()
Root cause is that sk_filter() can truncate the incoming skb,
but TCP stack was not really expecting this to happen.
It probably was expecting a simple DROP or ACCEPT behavior.
We first need to make sure no part of TCP header could be removed.
Then we need to adjust TCP_SKB_CB(skb)->end_seq
Many thanks to syzkaller team and Marco for giving us a reproducer.
Signed-off-by: Eric Dumazet <edumazet@google.com >
Reported-by: Marco Grassi <marco.gra@gmail.com >
Reported-by: Vladis Dronov <vdronov@redhat.com >
Signed-off-by: David S. Miller <davem@davemloft.net >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2016-11-21 10:06:40 +01:00
2015-04-11 22:28:27 -04:00
2015-11-05 04:04:00 +01:00
2015-02-20 17:35:14 -05:00
2015-09-21 16:03:04 -07:00
2015-11-10 23:47:32 +01:00
2015-10-14 06:01:07 -07:00
2015-10-28 06:44:45 +01:00
2015-12-06 22:31:51 -05:00
2015-09-18 21:59:31 +02:00
2015-10-21 00:49:25 +02:00
2015-08-26 11:01:44 -07:00
2015-09-24 12:26:08 -07:00
2015-09-17 13:20:05 +02:00
2016-09-30 10:18:36 +02:00
2015-11-01 12:14:47 -05:00
2015-03-04 00:23:23 -05:00
2015-06-28 16:55:44 -07:00
2015-11-02 22:52:24 -05:00
2015-07-27 01:05:24 -07:00
2016-04-20 15:42:04 +09:00
2015-11-03 10:54:58 +01:00
2015-09-30 13:16:44 +02:00
2015-08-17 21:33:06 -07:00
2015-02-11 14:46:37 -05:00
2015-07-20 12:41:30 -07:00
2016-05-18 17:06:39 -07:00
2015-04-09 00:02:26 -04:00
2015-03-06 21:50:02 -05:00
2015-09-17 17:18:37 -07:00
2015-11-01 15:56:11 -05:00
2016-03-03 15:07:04 -08:00
2015-10-08 04:27:02 -07:00
2015-12-14 23:52:00 -05:00
2015-09-23 15:33:15 -07:00
2015-09-09 14:19:50 -07:00
2015-09-01 16:46:08 -07:00
2015-10-07 04:27:42 -07:00
2015-09-24 12:25:23 -07:00
2015-08-27 15:42:48 -07:00
2015-08-10 14:03:54 -07:00
2015-08-31 15:17:17 -07:00
2015-09-30 13:16:44 +02:00
2015-03-23 22:12:09 -04:00
2015-10-03 04:32:42 -07:00
2015-03-18 22:00:35 -04:00
2015-11-02 22:46:09 -05:00
2016-03-03 15:07:07 -08:00
2016-01-31 11:29:01 -08:00
2015-11-02 22:47:14 -05:00
2015-10-23 05:42:21 -07:00
2015-12-07 17:07:33 -05:00
2015-10-20 06:08:27 -07:00
2015-12-16 00:14:12 -05:00
2015-11-15 17:12:37 -05:00
2016-03-03 15:07:05 -08:00
2016-11-21 10:06:39 +01:00
2016-03-03 15:07:07 -08:00
2016-10-31 04:13:59 -06:00
2016-05-11 11:21:09 +02:00
2016-11-15 07:46:39 +01:00
2015-12-02 23:37:16 -05:00
2016-03-16 08:42:59 -07:00
2016-01-04 22:58:30 -05:00
2015-05-11 10:50:17 -04:00
2015-10-08 04:27:03 -07:00
2015-11-20 11:39:40 +01:00
2015-10-21 00:49:24 +02:00
2015-10-23 06:26:42 -07:00
2015-12-01 15:07:59 -05:00
2015-08-10 13:46:21 -07:00
2015-08-07 11:50:56 +02:00
2015-09-30 13:16:44 +02:00
2015-09-30 13:16:44 +02:00
2015-03-02 13:06:31 -05:00
2015-08-27 14:18:48 -07:00
2015-10-16 00:52:19 -07:00
2016-01-04 22:58:30 -05:00
2015-10-21 19:15:20 -07:00
2016-11-15 07:46:37 +01:00
2016-03-03 15:07:05 -08:00
2016-11-15 07:46:36 +01:00
2016-06-24 10:18:16 -07:00
2015-03-12 22:58:12 -04:00
2016-11-21 10:06:40 +01:00
2015-07-09 15:12:20 -07:00
2015-10-26 22:24:22 -07:00
2015-08-29 13:07:54 -07:00
2015-03-02 13:06:31 -05:00
2015-12-05 18:15:29 -05:00
2015-12-11 19:22:06 -05:00
225a24ae97