tcp: do not underestimate skb->truesize in tcp_trim_head()
authorEric Dumazet <edumazet@google.com>
Thu, 27 Apr 2017 00:15:40 +0000 (17:15 -0700)
committerDavid S. Miller <davem@davemloft.net>
Fri, 28 Apr 2017 20:05:22 +0000 (16:05 -0400)
commit7162fb242cb8322beb558828fd26b33c3e9fc805
tree1d4240e28de77ffaf2180f17f3314b26a7bd1258
parent19cdead3e2ef8ed765c5d1ce48057ca9d97b5094
tcp: do not underestimate skb->truesize in tcp_trim_head()

Andrey found a way to trigger the WARN_ON_ONCE(delta < len) in
skb_try_coalesce() using syzkaller and a filter attached to a TCP
socket over loopback interface.

I believe one issue with looped skbs is that tcp_trim_head() can end up
producing skb with under estimated truesize.

It hardly matters for normal conditions, since packets sent over
loopback are never truncated.

Bytes trimmed from skb->head should not change skb truesize, since
skb->head is not reallocated.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/tcp_output.c