diff options
| author | Alexey Kodanev <alexey.kodanev@oracle.com> | 2015-03-27 12:24:22 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-03-29 13:36:05 -0700 |
| commit | 4ad19de8774e2a7b075b3e8ea48db85adcf33fa6 (patch) | |
| tree | e71b0da1f6f8b68c20ab7d26aa68dfbcdbcc584f /net/xfrm/xfrm_hash.h | |
| parent | 2ff2acf1fb65f1c83c41b67aba990c6d49a2274c (diff) | |
| download | linux-4ad19de8774e2a7b075b3e8ea48db85adcf33fa6.tar.bz2 | |
net: tcp6: fix double call of tcp_v6_fill_cb()
tcp_v6_fill_cb() will be called twice if socket's state changes from
TCP_TIME_WAIT to TCP_LISTEN. That can result in control buffer data
corruption because in the second tcp_v6_fill_cb() call it's not copying
IP6CB(skb) anymore, but 'seq', 'end_seq', etc., so we can get weird and
unpredictable results. Performance loss of up to 1200% has been observed
in LTP/vxlan03 test.
This can be fixed by copying inet6_skb_parm to the beginning of 'cb'
only if xfrm6_policy_check() and tcp_v6_fill_cb() are going to be
called again.
Fixes: 2dc49d1680b53 ("tcp6: don't move IP6CB before xfrm6_policy_check()")
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/xfrm/xfrm_hash.h')
0 files changed, 0 insertions, 0 deletions