Re: [RFC PATCH] tcp: use of undefined variable
From: David Miller <davem@davemloft.net>
Date: 2012-09-20 21:31:52
From: Alan Cox <redacted> Date: Wed, 19 Sep 2012 15:46:06 +0100
From: Alan Cox <redacted> Both tcp_timewait_state_process and tcp_check_req use the same basic construct of struct tcp_options received tmp_opt; tmp_opt.saw_tstamp = 0; then call tcp_parse_options However if they are fed a frame containing a TCP_SACK then tbe code behaviour is undefined because opt_rx->sack_ok is undefined data. This ought to be documented if it is intentional. Signed-off-by: Alan Cox <redacted>
Applied to net-next, except I took this hunk out:
quoted hunk ↗ jump to hunk
@@ -96,6 +98,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb, bool paws_reject = false; tmp_opt.saw_tstamp = 0; + if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) { tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
Since it's unrelated to your change, and if you were going to do this in tcp_timewait_state_process() you should do it in tcp_check_req() as well since the code is identical. Longer term maybe we probably should add a tcp_minisock_parse_options() that elides TCP_SACK and other bits these cases do not want. Thanks Alan.