提交 4f4abb4d 编写于 作者: W Wang Yufen 提交者: Yang Yingliang

tcp_comp: Fix comp_read_size return value

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I47SV5?from=project-issue
CVE: NA

-------------------------------------------------

In comp_read_size rxm->offset should be subtracted from skb->len. And use
strp_done to release resoureces when destroy sock.
Signed-off-by: NWang Yufen <wangyufen@huawei.com>
Reviewed-by: NWei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: NYue Haibing <yuehaibing@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
上级 ce94d6a1
...@@ -789,7 +789,7 @@ static int comp_read_size(struct strparser *strp, struct sk_buff *skb) ...@@ -789,7 +789,7 @@ static int comp_read_size(struct strparser *strp, struct sk_buff *skb)
if (rxm->offset > skb->len) if (rxm->offset > skb->len)
return 0; return 0;
return skb->len; return skb->len - rxm->offset;
} }
void comp_setup_strp(struct sock *sk, struct tcp_comp_context *ctx) void comp_setup_strp(struct sock *sk, struct tcp_comp_context *ctx)
...@@ -903,6 +903,7 @@ static void tcp_comp_context_free(struct rcu_head *head) ...@@ -903,6 +903,7 @@ static void tcp_comp_context_free(struct rcu_head *head)
tcp_comp_context_tx_free(ctx); tcp_comp_context_tx_free(ctx);
tcp_comp_context_rx_free(ctx); tcp_comp_context_rx_free(ctx);
strp_done(&ctx->rx.strp);
kfree(ctx); kfree(ctx);
} }
...@@ -923,6 +924,7 @@ void tcp_cleanup_compression(struct sock *sk) ...@@ -923,6 +924,7 @@ void tcp_cleanup_compression(struct sock *sk)
kfree_skb(ctx->rx.pkt); kfree_skb(ctx->rx.pkt);
ctx->rx.pkt = NULL; ctx->rx.pkt = NULL;
} }
strp_stop(&ctx->rx.strp);
rcu_assign_pointer(icsk->icsk_ulp_data, NULL); rcu_assign_pointer(icsk->icsk_ulp_data, NULL);
call_rcu(&ctx->rcu, tcp_comp_context_free); call_rcu(&ctx->rcu, tcp_comp_context_free);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册