aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv4/tcp.c
diff options
context:
space:
mode:
authorSrinivas Aji <Aji_Srinivas@emc.com>2007-05-03 20:32:28 -0400
committerDavid S. Miller <davem@davemloft.net>2007-05-03 20:32:28 -0400
commitb40b4f79ce789e9e28d382c85006f62be2725282 (patch)
tree0764b390c4077f4569597678881487f718d25706 /net/ipv4/tcp.c
parentfde82055c1d0e64ff660d83c705db0e1abc9d12e (diff)
[TCP]: zero out rx_opt in tcp_disconnect()
When the server drops its connection, NFS client reconnects using the same socket after disconnecting. If the new connection's SYN,ACK doesn't contain the TCP timestamp option and the old connection's did, tp->tcp_header_len is recomputed assuming no timestamp header but tp->rx_opt.tstamp_ok remains set. Then tcp_build_and_update_options() adds in a timestamp option past the end of the allocated TCP header, overwriting TCP data, or when the data is in skb_shinfo(skb)->frags[], overwriting skb_shinfo(skb) causing a crash soon after. (The issue was debugged from such a crash.) Similarly, wscale_ok and sack_ok also get set based on the SYN,ACK packet but not reset on disconnect, since they are zeroed out at initialization. The patch zeroes out the entire tp->rx_opt struct in tcp_disconnect() to avoid this sort of problem. Signed-off-by: Srinivas Aji <Aji_Srinivas@emc.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp.c')
-rw-r--r--net/ipv4/tcp.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index d6e488668171..8b124eafbb90 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1760,8 +1760,7 @@ int tcp_disconnect(struct sock *sk, int flags)
1760 tcp_clear_retrans(tp); 1760 tcp_clear_retrans(tp);
1761 inet_csk_delack_init(sk); 1761 inet_csk_delack_init(sk);
1762 tcp_init_send_head(sk); 1762 tcp_init_send_head(sk);
1763 tp->rx_opt.saw_tstamp = 0; 1763 memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
1764 tcp_sack_reset(&tp->rx_opt);
1765 __sk_dst_reset(sk); 1764 __sk_dst_reset(sk);
1766 1765
1767 BUG_TRAP(!inet->num || icsk->icsk_bind_hash); 1766 BUG_TRAP(!inet->num || icsk->icsk_bind_hash);