diff options
| author | Pavel Emelyanov <xemul@parallels.com> | 2012-05-10 01:50:01 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-05-10 23:24:35 -0400 |
| commit | 3c961afed4d4e766b66092e7af8c8e8005053505 (patch) | |
| tree | 1bc4194a29e125bac5585ee2a45a94e8abc7a408 /net/ipv4 | |
| parent | 292e8d8c853889140ed77b7b37c66979b13080ae (diff) | |
| download | linux-3.10-3c961afed4d4e766b66092e7af8c8e8005053505.tar.gz linux-3.10-3c961afed4d4e766b66092e7af8c8e8005053505.tar.bz2 linux-3.10-3c961afed4d4e766b66092e7af8c8e8005053505.zip | |
tcp: Schedule rmem for rcvq repair send
As noted by Eric, no checks are performed on the data size we're
putting in the read queue during repair. Thus, validate the given
data size with the common rmem management routine.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/tcp_input.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 7c6c99dcc96..164659f2d63 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -4769,6 +4769,9 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size) struct tcphdr *th; bool fragstolen; + if (tcp_try_rmem_schedule(sk, size + sizeof(*th))) + goto err; + skb = alloc_skb(size + sizeof(*th), sk->sk_allocation); if (!skb) goto err; |