]> git.baikalelectronics.ru Git - kernel.git/commit
tcp: fix NULL ref in tail loss probe
authorYuchung Cheng <ycheng@google.com>
Wed, 5 Dec 2018 22:38:38 +0000 (14:38 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 6 Dec 2018 00:34:40 +0000 (16:34 -0800)
commit59bfd20529f45b6652a6913aec39f0f2026a14d9
treee50108978bd22380b6d831725c8998bdd2a797d7
parentb2d5ba5aed0c569eee511ce8336ce48b82dbaafa
tcp: fix NULL ref in tail loss probe

TCP loss probe timer may fire when the retranmission queue is empty but
has a non-zero tp->packets_out counter. tcp_send_loss_probe will call
tcp_rearm_rto which triggers NULL pointer reference by fetching the
retranmission queue head in its sub-routines.

Add a more detailed warning to help catch the root cause of the inflight
accounting inconsistency.

Reported-by: Rafael Tinoco <rafael.tinoco@linaro.org>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/tcp_output.c