TCP: Make sure write_queue_from does not begin with NULL ptr (CVE-2007-5501)
authorIlpo Järvinen <ilpo.jarvinen@helsinki.fi>
Wed, 14 Nov 2007 23:47:18 +0000 (15:47 -0800)
committerGreg Kroah-Hartman <gregkh@suse.de>
Fri, 16 Nov 2007 18:10:56 +0000 (10:10 -0800)
commitb0f08ee5e5b8dfc3a875a41c24db878373274799
treea9ddf570659fc4d2d403e004474826424a286ff7
parent8ea7fff57e22d95788f0a2b3115687f77fd8099d
TCP: Make sure write_queue_from does not begin with NULL ptr (CVE-2007-5501)

patch 96a2d41a3e495734b63bff4e5dd0112741b93b38 in mainline.

NULL ptr can be returned from tcp_write_queue_head to cached_skb
and then assigned to skb if packets_out was zero. Without this,
system is vulnerable to a carefully crafted ACKs which obviously
is remotely triggerable.

Besides, there's very little that needs to be done in sacktag
if there weren't any packets outstanding, just skipping the rest
doesn't hurt.

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/tcp_input.c