Please sign in to comment.
tcp: take care of truncations done by sk_filter()
With syzkaller help, Marco Grassi found a bug in TCP stack, crashing in tcp_collapse() Root cause is that sk_filter() can truncate the incoming skb, but TCP stack was not really expecting this to happen. It probably was expecting a simple DROP or ACCEPT behavior. We first need to make sure no part of TCP header could be removed. Then we need to adjust TCP_SKB_CB(skb)->end_seq Many thanks to syzkaller team and Marco for giving us a reproducer. Signed-off-by: Eric Dumazet <email@example.com> Reported-by: Marco Grassi <firstname.lastname@example.org> Reported-by: Vladis Dronov <email@example.com> Signed-off-by: David S. Miller <firstname.lastname@example.org>
- Loading branch information...
Showing with 23 additions and 3 deletions.