]> git.baikalelectronics.ru Git - kernel.git/commit
tcp: fix NULL ref in tail loss probe
authorYuchung Cheng <ycheng@google.com>
Wed, 5 Dec 2018 22:38:38 +0000 (14:38 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 6 Dec 2018 00:34:40 +0000 (16:34 -0800)
commit862113b2c7d782eb17a1e53996ad449b5f7ebfed
treee50108978bd22380b6d831725c8998bdd2a797d7
parentb2e00529242ae5742b5baac2ae9ef4632299bb08
tcp: fix NULL ref in tail loss probe

TCP loss probe timer may fire when the retranmission queue is empty but
has a non-zero tp->packets_out counter. tcp_send_loss_probe will call
tcp_rearm_rto which triggers NULL pointer reference by fetching the
retranmission queue head in its sub-routines.

Add a more detailed warning to help catch the root cause of the inflight
accounting inconsistency.

Reported-by: Rafael Tinoco <rafael.tinoco@linaro.org>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/tcp_output.c