)]}'
{
  "commit": "9fa5fdf291c9b58b1cb8b4bb2a0ee57efa21d635",
  "tree": "cfa28bcf674ef224a5ab66b3b8bc4bc1091ccb11",
  "parents": [
    "a7a41acf99d9150b424839b0d7b4f5ad9d211e2d"
  ],
  "author": {
    "name": "Dimitris Michailidis",
    "email": "dm@chelsio.com",
    "time": "Mon Jan 26 22:15:31 2009 -0800"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Mon Jan 26 22:15:31 2009 -0800"
  },
  "message": "tcp: Fix length tcp_splice_data_recv passes to skb_splice_bits.\n\ntcp_splice_data_recv has two lengths to consider: the len parameter it\ngets from tcp_read_sock, which specifies the amount of data in the skb,\nand rd_desc-\u003ecount, which is the amount of data the splice caller still\nwants.  Currently it passes just the latter to skb_splice_bits, which then\nsplices min(rd_desc-\u003ecount, skb-\u003elen - offset) bytes.\n\nMost of the time this is fine, except when the skb contains urgent data.\nIn that case len goes only up to the urgent byte and is less than\nskb-\u003elen - offset.  By ignoring len tcp_splice_data_recv may a) splice\ndata tcp_read_sock told it not to, b) return to tcp_read_sock a value \u003e len.\n\nNow, tcp_read_sock doesn\u0027t handle used \u003e len and leaves the socket in a\nbad state (both sk_receive_queue and copied_seq are bad at that point)\nresulting in duplicated data and corruption.\n\nFix by passing min(rd_desc-\u003ecount, len) to skb_splice_bits.\n\nSigned-off-by: Dimitris Michailidis \u003cdm@chelsio.com\u003e\nAcked-by: Eric Dumazet \u003cdada1@cosmosbay.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0cd71b84e483d3a1685bde2e947117b8a24aac91",
      "old_mode": 33188,
      "old_path": "net/ipv4/tcp.c",
      "new_id": "76b148bcb0dcb9ffcb333aa2b3ab3a2ed68fad33",
      "new_mode": 33188,
      "new_path": "net/ipv4/tcp.c"
    }
  ]
}