From: Eric Dumazet <eric.duma...@gmail.com> Date: Thu, 10 Nov 2016 13:12:35 -0800
> From: Eric Dumazet <eduma...@google.com> > > With syzkaller help, Marco Grassi found a bug in TCP stack, > crashing in tcp_collapse() > > Root cause is that sk_filter() can truncate the incoming skb, > but TCP stack was not really expecting this to happen. > It probably was expecting a simple DROP or ACCEPT behavior. > > We first need to make sure no part of TCP header could be removed. > Then we need to adjust TCP_SKB_CB(skb)->end_seq > > Many thanks to syzkaller team and Marco for giving us a reproducer. > > Signed-off-by: Eric Dumazet <eduma...@google.com> > Reported-by: Marco Grassi <marco....@gmail.com> > Reported-by: Vladis Dronov <vdro...@redhat.com> > --- > v2: reload both th/iph in case skb->head changed. Applied and queued up for -stable, thanks Eric.
