diff options
| author | Eric Dumazet <edumazet@google.com> | 2019-12-05 19:10:15 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-12-07 05:47:38 +0100 |
| commit | 9424e2e7ad93ffffa88f882c9bc5023570904b55 (patch) | |
| tree | 186b56068fd9de539f240ec1ab8cf81fb9ed7a39 /drivers | |
| parent | Merge branch 'net-tc-indirect-block-relay' (diff) | |
| download | linux-9424e2e7ad93ffffa88f882c9bc5023570904b55.tar.xz linux-9424e2e7ad93ffffa88f882c9bc5023570904b55.zip | |
tcp: md5: fix potential overestimation of TCP option space
Back in 2008, Adam Langley fixed the corner case of packets for flows
having all of the following options : MD5 TS SACK
Since MD5 needs 20 bytes, and TS needs 12 bytes, no sack block
can be cooked from the remaining 8 bytes.
tcp_established_options() correctly sets opts->num_sack_blocks
to zero, but returns 36 instead of 32.
This means TCP cooks packets with 4 extra bytes at the end
of options, containing unitialized bytes.
Fixes: 33ad798c924b ("tcp: options clean up")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions