Skip to content

Commit baff42a

Browse files
smagnanidavem330
authored andcommitted
net: Fix oops from tcp_collapse() when using splice()
tcp_read_sock() can have a eat skbs without immediately advancing copied_seq. This can cause a panic in tcp_collapse() if it is called as a result of the recv_actor dropping the socket lock. A userspace program that splices data from a socket to either another socket or to a file can trigger this bug. Signed-off-by: Steven J. Magnani <steve@digidescorp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent c0cd884 commit baff42a

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

Diff for: net/ipv4/tcp.c

+1
Original file line numberDiff line numberDiff line change
@@ -1368,6 +1368,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
13681368
sk_eat_skb(sk, skb, 0);
13691369
if (!desc->count)
13701370
break;
1371+
tp->copied_seq = seq;
13711372
}
13721373
tp->copied_seq = seq;
13731374

0 commit comments

Comments
 (0)