Re: [PATCH net] tcp: fix potential memory corruption

2016-11-03 Thread David Miller
From: Eric Dumazet Date: Wed, 02 Nov 2016 07:53:17 -0700 > From: Eric Dumazet > > Imagine initial value of max_skb_frags is 17, and last > skb in write queue has 15 frags. > > Then max_skb_frags is lowered to 14 or smaller value. > > tcp_sendmsg() will then be allowed to add additional page f

[PATCH net] tcp: fix potential memory corruption

2016-11-02 Thread Eric Dumazet
From: Eric Dumazet Imagine initial value of max_skb_frags is 17, and last skb in write queue has 15 frags. Then max_skb_frags is lowered to 14 or smaller value. tcp_sendmsg() will then be allowed to add additional page frags and eventually go past MAX_SKB_FRAGS, overflowing struct skb_shared_in