Commit 58ab57d4 authored by Lu Wei's avatar Lu Wei Committed by Zheng Zengkai
Browse files

tcp_comp: Fix receives err when server receives a large packet

hulk inclusion
category: bugfix
bugzilla: 186745, https://gitee.com/openeuler/kernel/issues/I60M9A


CVE: NA

----------------------------------------

When tcp compression is uses, if server receives a large packet,
which is larger than PAGE_SIZES * MAX_SKB_FRAGS bytes, it needs
more than one skb to store the data since one skb can only store
PAGE_SIZES * MAX_SKB_FRAGS bytes data.
    In function tcp_comp_decompress(), it breaks the while-loop
which copy decompressed data to new skb when more than MAX_SKB_FRAGS
pages is needed, causing part of data is copied into the new skb and
received by user but the compressed_len is not added. In this case,
the data will be decompressed infinitely.
    The patch limits the decompressed length so it can be copied
into one skb. Moreover, once a skb is full, quit decompress process
directly.

Fixes: c31c696f ("tcp_comp: Del compressed_data and remaining_data from tcp_comp_context_rx")
Signed-off-by: default avatarLu Wei <luwei32@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent d38abaf8
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment