summaryrefslogtreecommitdiffstats
path: root/net/ipv4
diff options
context:
space:
mode:
authorPavel Emelyanov <xemul@parallels.com>2012-05-10 01:50:01 +0000
committerDavid S. Miller <davem@davemloft.net>2012-05-10 23:24:35 -0400
commit3c961afed4d4e766b66092e7af8c8e8005053505 (patch)
tree1bc4194a29e125bac5585ee2a45a94e8abc7a408 /net/ipv4
parent292e8d8c853889140ed77b7b37c66979b13080ae (diff)
downloadlinux-3c961afed4d4e766b66092e7af8c8e8005053505.tar.bz2
tcp: Schedule rmem for rcvq repair send
As noted by Eric, no checks are performed on the data size we're putting in the read queue during repair. Thus, validate the given data size with the common rmem management routine. Signed-off-by: Pavel Emelyanov <xemul@parallels.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/tcp_input.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 7c6c99dcc962..164659f2d636 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4769,6 +4769,9 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
struct tcphdr *th;
bool fragstolen;
+ if (tcp_try_rmem_schedule(sk, size + sizeof(*th)))
+ goto err;
+
skb = alloc_skb(size + sizeof(*th), sk->sk_allocation);
if (!skb)
goto err;