Hi,
There seem to be a few unaligned accesses when parsing arbitrary TCP options
(in the slow path function tcp_parse_options).
The following is a possible fix.
Matt
--- linux-2.5.2/net/ipv4/tcp_input.old Mon Dec 17 17:49:14 2001
+++ linux-2.5.2/net/ipv4/tcp_input.c Sat Jan 26 21:37:57 2002
@@ -68,6 +68,7 @@
#include <net/tcp.h>
#include <net/inet_common.h>
#include <linux/ipsec.h>
+#include <asm/unaligned.h>
int sysctl_tcp_timestamps = 1;
int sysctl_tcp_window_scaling = 1;
@@ -2020,7 +2021,7 @@
switch(opcode) {
case TCPOPT_MSS:
if(opsize==TCPOLEN_MSS && th->syn && !estab) {
- u16 in_mss = ntohs(*(__u16 *)ptr);
+ u16 in_mss = ntohs(get_unaligned((__u16 *)ptr));
if (in_mss) {
if (tp->user_mss && tp->user_mss < in_mss)
in_mss = tp->user_mss;
@@ -2047,8 +2048,8 @@
if ((estab && tp->tstamp_ok) ||
(!estab && sysctl_tcp_timestamps)) {
tp->saw_tstamp = 1;
- tp->rcv_tsval = ntohl(*(__u32 *)ptr);
- tp->rcv_tsecr = ntohl(*(__u32 *)(ptr+4));
+ tp->rcv_tsval = ntohl(get_unaligned((__u32 *)ptr));
+ tp->rcv_tsecr = ntohl(get_unaligned((__u32 *)(ptr+4)));
}
}
break;
-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
