diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 3de804531231..dd9be5169aa3 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -805,6 +805,9 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb } } + if (size + TCPOLEN_SACK_BASE_ALIGNED >= MAX_TCP_OPTION_SPACE) + return size; + eff_sacks = tp->rx_opt.num_sacks + tp->rx_opt.dsack; if (unlikely(eff_sacks)) { const unsigned int remaining = MAX_TCP_OPTION_SPACE - size;
The SACK code would potentially add four bytes to the expected TCP option size even if all option space was already used. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com> --- net/ipv4/tcp_output.c | 3 +++ 1 file changed, 3 insertions(+)