[PATCH stable 4.4 2/9] Revert "tcp: avoid collapses in tcp_prune_queue() if possible"

2018-08-15 Thread Mao Wenan
This reverts commit 5fbec4801264cb3279ef6ac9c70bcbe2aaef89d5.

We need change simple queue to RB tree to finally fix CVE-2018-5390, So
revert this patch firstly because of many conflicts when we want to apply 
previous patch 9f5afeae(tcp: use an RB tree for ooo receive queue), after 
this we will reapply patch series from Eric.

Signed-off-by: Mao Wenan 
---
 net/ipv4/tcp_input.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 995b2bc..df2f342 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4877,9 +4877,6 @@ static int tcp_prune_queue(struct sock *sk)
else if (tcp_under_memory_pressure(sk))
tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss);
 
-   if (atomic_read(>sk_rmem_alloc) <= sk->sk_rcvbuf)
-   return 0;
-
tcp_collapse_ofo_queue(sk);
if (!skb_queue_empty(>sk_receive_queue))
tcp_collapse(sk, >sk_receive_queue,
-- 
1.8.3.1



Re: [PATCH stable 4.4 2/9] Revert "tcp: avoid collapses in tcp_prune_queue() if possible"

2018-08-15 Thread Greg KH
On Wed, Aug 15, 2018 at 09:21:01PM +0800, Mao Wenan wrote:
> This reverts commit 5fbec4801264cb3279ef6ac9c70bcbe2aaef89d5.
> ---

Same here for description and signed off by.

thanks,

greg k-h


[PATCH stable 4.4 2/9] Revert "tcp: avoid collapses in tcp_prune_queue() if possible"

2018-08-15 Thread Mao Wenan
This reverts commit 5fbec4801264cb3279ef6ac9c70bcbe2aaef89d5.
---
 net/ipv4/tcp_input.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 995b2bc..df2f342 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4877,9 +4877,6 @@ static int tcp_prune_queue(struct sock *sk)
else if (tcp_under_memory_pressure(sk))
tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss);
 
-   if (atomic_read(>sk_rmem_alloc) <= sk->sk_rcvbuf)
-   return 0;
-
tcp_collapse_ofo_queue(sk);
if (!skb_queue_empty(>sk_receive_queue))
tcp_collapse(sk, >sk_receive_queue,
-- 
1.8.3.1