tcp: avoid infinite loop in tcp_splice_read()

Splicing from TCP socket is vulnerable when a packet with URG flag is
received and stored into receive queue.

__tcp_splice_read() returns 0, and sk_wait_data() immediately
returns since there is the problematic skb in queue.

This is a nice way to burn cpu (aka infinite loop) and trigger
soft lockups.

Again, this gem was found by syzkaller tool.

Fixes: 9c55e01c0cc8 ("[TCP]: Splice receive support.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov  <dvyukov@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 0 deletions

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c

path: root/fs/afs/Kconfig

config AFS_FS
	tristate "Andrew File System support (AFS)"
	depends on INET
	select AF_RXRPC
	select DNS_RESOLVER
	help
	  If you say Y here, you will get an experimental Andrew File System
	  driver. It currently only supports unsecured read-only AFS access.

	  See <file:Documentation/filesystems/afs.txt> for more information.

	  If unsure, say N.

config AFS_DEBUG
	bool "AFS dynamic debugging"
	depends on AFS_FS
	help
	  Say Y here to make runtime controllable debugging messages appear.

	  See <file:Documentation/filesystems/afs.txt> for more information.

	  If unsure, say N.

config AFS_FSCACHE
	bool "Provide AFS client caching support"
	depends on AFS_FS=m && FSCACHE || AFS_FS=y && FSCACHE=y
	help
	  Say Y here if you want AFS data to be cached locally on disk through
	  the generic filesystem cache manager