]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
tcp: refine memory limit test in tcp_fragment()
authorEric Dumazet <edumazet@google.com>
Fri, 21 Jun 2019 13:09:55 +0000 (06:09 -0700)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Mon, 24 Jun 2019 09:39:06 +0000 (11:39 +0200)
commita63f10d7e53d7e41a9f3517c1d4f49c792cc4fef
tree493c029a6fb0c28ed85fdad2369594eac13ce624
parent524951b60e4e108b0fb903a6cc14b8e83bc5a7e7
tcp: refine memory limit test in tcp_fragment()

tcp_fragment() might be called for skbs in the write queue.

Memory limits might have been exceeded because tcp_sendmsg() only
checks limits at full skb (64KB) boundaries.

Therefore, we need to make sure tcp_fragment() wont punish applications
that might have setup very low SO_SNDBUF values.

Fixes: f070ef2ac667 ("tcp: tcp_fragment() should apply sane memory limits")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Christoph Paasch <cpaasch@apple.com>
Tested-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
BugLink: https://bugs.launchpad.net/bugs/1831638
CVE-2019-11478

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
net/ipv4/tcp_output.c