From: Eric Dumazet <[email protected]> Date: Fri, 03 Feb 2017 14:59:38 -0800
> From: Eric Dumazet <[email protected]> > > Splicing from TCP socket is vulnerable when a packet with URG flag is > received and stored into receive queue. > > __tcp_splice_read() returns 0, and sk_wait_data() immediately > returns since there is the problematic skb in queue. > > This is a nice way to burn cpu (aka infinite loop) and trigger > soft lockups. > > Again, this gem was found by syzkaller tool. > > Fixes: 9c55e01c0cc8 ("[TCP]: Splice receive support.") > Signed-off-by: Eric Dumazet <[email protected]> > Reported-by: Dmitry Vyukov <[email protected]> > Cc: Willy Tarreau <[email protected]> Applied and queued up for -stable, thanks Eric.
