wpa_supplicant: fix CVE-2018-14526
[openwrt/staging/wigyori.git] / target / linux / generic / backport-4.9 / 100-tcp-add-tcp_ooo_try_coalesce-helper.patch
1 From 74b120c45aebf4278e1dedc55f5fa24d8ea83cdc Mon Sep 17 00:00:00 2001
2 From: Eric Dumazet <edumazet@google.com>
3 Date: Mon, 23 Jul 2018 09:28:21 -0700
4 Subject: tcp: add tcp_ooo_try_coalesce() helper
5
6 commit 58152ecbbcc6a0ce7fddd5bf5f6ee535834ece0c upstream.
7
8 In case skb in out_or_order_queue is the result of
9 multiple skbs coalescing, we would like to get a proper gso_segs
10 counter tracking, so that future tcp_drop() can report an accurate
11 number.
12
13 I chose to not implement this tracking for skbs in receive queue,
14 since they are not dropped, unless socket is disconnected.
15
16 Signed-off-by: Eric Dumazet <edumazet@google.com>
17 Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
18 Acked-by: Yuchung Cheng <ycheng@google.com>
19 Signed-off-by: David S. Miller <davem@davemloft.net>
20 Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
22 ---
23 net/ipv4/tcp_input.c | 23 +++++++++++++++++++++--
24 1 file changed, 21 insertions(+), 2 deletions(-)
25
26 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
27 index a9be8df108b4..9d0b73aa649f 100644
28 --- a/net/ipv4/tcp_input.c
29 +++ b/net/ipv4/tcp_input.c
30 @@ -4370,6 +4370,23 @@ static bool tcp_try_coalesce(struct sock *sk,
31 return true;
32 }
33
34 +static bool tcp_ooo_try_coalesce(struct sock *sk,
35 + struct sk_buff *to,
36 + struct sk_buff *from,
37 + bool *fragstolen)
38 +{
39 + bool res = tcp_try_coalesce(sk, to, from, fragstolen);
40 +
41 + /* In case tcp_drop() is called later, update to->gso_segs */
42 + if (res) {
43 + u32 gso_segs = max_t(u16, 1, skb_shinfo(to)->gso_segs) +
44 + max_t(u16, 1, skb_shinfo(from)->gso_segs);
45 +
46 + skb_shinfo(to)->gso_segs = min_t(u32, gso_segs, 0xFFFF);
47 + }
48 + return res;
49 +}
50 +
51 static void tcp_drop(struct sock *sk, struct sk_buff *skb)
52 {
53 sk_drops_add(sk, skb);
54 @@ -4493,7 +4510,8 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
55 /* In the typical case, we are adding an skb to the end of the list.
56 * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup.
57 */
58 - if (tcp_try_coalesce(sk, tp->ooo_last_skb, skb, &fragstolen)) {
59 + if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb,
60 + skb, &fragstolen)) {
61 coalesce_done:
62 tcp_grow_window(sk, skb);
63 kfree_skb_partial(skb, fragstolen);
64 @@ -4543,7 +4561,8 @@ coalesce_done:
65 tcp_drop(sk, skb1);
66 goto merge_right;
67 }
68 - } else if (tcp_try_coalesce(sk, skb1, skb, &fragstolen)) {
69 + } else if (tcp_ooo_try_coalesce(sk, skb1,
70 + skb, &fragstolen)) {
71 goto coalesce_done;
72 }
73 p = &parent->rb_right;
74 --
75 cgit 1.2-0.3.lf.el7
76