From: Eric Dumazet <[email protected]> Date: Thu, 10 Nov 2016 13:12:35 -0800
> From: Eric Dumazet <[email protected]> > > With syzkaller help, Marco Grassi found a bug in TCP stack, > crashing in tcp_collapse() > > Root cause is that sk_filter() can truncate the incoming skb, > but TCP stack was not really expecting this to happen. > It probably was expecting a simple DROP or ACCEPT behavior. > > We first need to make sure no part of TCP header could be removed. > Then we need to adjust TCP_SKB_CB(skb)->end_seq > > Many thanks to syzkaller team and Marco for giving us a reproducer. > > Signed-off-by: Eric Dumazet <[email protected]> > Reported-by: Marco Grassi <[email protected]> > Reported-by: Vladis Dronov <[email protected]> > --- > v2: reload both th/iph in case skb->head changed. Applied and queued up for -stable, thanks Eric.
