This is a note to let you know that I've just added the patch titled
tcp: len check is unnecessarily devastating, change to WARN_ON
to the 2.6.38-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
tcp-len-check-is-unnecessarily-devastating-change-to-warn_on.patch
and it can be found in the queue-2.6.38 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From fe5727fa719f4b3fe8b8cba9dcedf7e044b5a9b6 Mon Sep 17 00:00:00 2001
From: Ilpo Järvinen <[email protected]>
Date: Fri, 1 Apr 2011 21:47:41 -0700
Subject: tcp: len check is unnecessarily devastating, change to WARN_ON
From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <[email protected]>
[ Upstream commit 2fceec13375e5d98ef033c6b0ee03943fc460950 ]
All callers are prepared for alloc failures anyway, so this error
can safely be boomeranged to the callers domain without super
bad consequences. ...At worst the connection might go into a state
where each RTO tries to (unsuccessfully) re-fragment with such
a mis-sized value and eventually dies.
Signed-off-by: Ilpo Järvinen <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/ipv4/tcp_output.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1003,7 +1003,8 @@ int tcp_fragment(struct sock *sk, struct
int nlen;
u8 flags;
- BUG_ON(len > skb->len);
+ if (WARN_ON(len > skb->len))
+ return -EINVAL;
nsize = skb_headlen(skb) - len;
if (nsize < 0)
Patches currently in stable-queue which might be from [email protected]
are
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
