Messages in this thread | | | From | Eric Dumazet <> | Date | Tue, 4 Aug 2020 07:34:07 -0700 | Subject | Re: [PATCH] net: Fix potential out of bound write in skb_try_coalesce() |
| |
On Tue, Aug 4, 2020 at 4:46 AM linmiaohe <linmiaohe@huawei.com> wrote: > > From: Miaohe Lin <linmiaohe@huawei.com> > > The head_frag of skb would occupy one extra skb_frag_t. Take it into > account or out of bound write to skb frags may happen. > > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Please share a stack trace if this was a real bug spotted in the wild.
I do not believe this patch is correct.
if (A + B >= MAX) is equivalent to if (A + B + 1 > MAX)
Note how the other condition (when there is no bytes in skb header) is coded :
if (A + B > MAX) return false;
In anycase, please always provide a Fixes: tag for any bug fix.
Thanks.
| |