diff options
| author | Borislav Petkov <bp@suse.de> | 2021-03-15 10:49:00 +0100 |
|---|---|---|
| committer | Borislav Petkov <bp@suse.de> | 2021-03-15 10:49:00 +0100 |
| commit | aa7680f6fe21ba92c3d633e345f85d4125cd56f1 (patch) | |
| tree | 238310342ae16eb5a2cdc9e032d972936cc3fe77 /net/ipv4/tcp.c | |
| parent | d0962f2b24c99889a386f0658c71535f56358f77 (diff) | |
| parent | 1e28eed17697bcf343c6743f0028cc3b5dd88bf0 (diff) | |
| download | linux-aa7680f6fe21ba92c3d633e345f85d4125cd56f1.tar.gz linux-aa7680f6fe21ba92c3d633e345f85d4125cd56f1.tar.bz2 linux-aa7680f6fe21ba92c3d633e345f85d4125cd56f1.zip | |
Merge tag 'v5.12-rc3' into x86/core
Pick up dependent SEV-ES urgent changes to base new work ontop.
Signed-off-by: Borislav Petkov <bp@suse.de>
Diffstat (limited to 'net/ipv4/tcp.c')
| -rw-r--r-- | net/ipv4/tcp.c | 26 |
1 files changed, 17 insertions, 9 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index a3422e42784e..de7cc8445ac0 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3469,16 +3469,23 @@ static int do_tcp_setsockopt(struct sock *sk, int level, int optname, break; case TCP_QUEUE_SEQ: - if (sk->sk_state != TCP_CLOSE) + if (sk->sk_state != TCP_CLOSE) { err = -EPERM; - else if (tp->repair_queue == TCP_SEND_QUEUE) - WRITE_ONCE(tp->write_seq, val); - else if (tp->repair_queue == TCP_RECV_QUEUE) { - WRITE_ONCE(tp->rcv_nxt, val); - WRITE_ONCE(tp->copied_seq, val); - } - else + } else if (tp->repair_queue == TCP_SEND_QUEUE) { + if (!tcp_rtx_queue_empty(sk)) + err = -EPERM; + else + WRITE_ONCE(tp->write_seq, val); + } else if (tp->repair_queue == TCP_RECV_QUEUE) { + if (tp->rcv_nxt != tp->copied_seq) { + err = -EPERM; + } else { + WRITE_ONCE(tp->rcv_nxt, val); + WRITE_ONCE(tp->copied_seq, val); + } + } else { err = -EINVAL; + } break; case TCP_REPAIR_OPTIONS: @@ -4143,7 +4150,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level, if (get_user(len, optlen)) return -EFAULT; - if (len < offsetofend(struct tcp_zerocopy_receive, length)) + if (len < 0 || + len < offsetofend(struct tcp_zerocopy_receive, length)) return -EINVAL; if (unlikely(len > sizeof(zc))) { err = check_zeroed_user(optval + sizeof(zc), |