Skip to contentSkip to conversation

tcp: clear tp->packets_out when purging write queue

PATCH In review Soheil Hassas Yeganeh 2 participants 2 messages Apr 15, 2018 – Apr 16, 2018

Subsystems (3)
Networking Network drivers TCP
lore
Share & tools
lore

Soheil Hassas Yeganeh

author
#0 lore raw

PATCH 1/1 tcp: clear tp->packets_out when purging write queue

From: Soheil Hassas Yeganeh <[email protected]>

Clear tp->packets_out when purging the write queue, otherwise tcp_rearm_rto() mistakenly assumes TCP write queue is not empty. This results in NULL pointer dereference.

Also, remove the redundant tp->packets_out = 0 from tcp_disconnect(), since tcp_disconnect() calls tcp_write_queue_purge().

Fixes a27fd7a8ed38 (tcp: purge write queue upon RST)
Reported-by Subash Abhinov Kasiviswanathan <[email protected]>
Reported-by Sami Farin <[email protected]>
Tested-by Sami Farin <[email protected]>
Signed-off-by Eric Dumazet <[email protected]>
Signed-off-by Soheil Hassas Yeganeh <[email protected]>
Acked-by Yuchung Cheng <[email protected]>
Acked-by Neal Cardwell <[email protected]>
---
 net/ipv4/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp.c +1 -1
index 4fa3f812b9ff8..9ce1c726185eb 100644
@@ -2368,6 +2368,7 @@ void tcp_write_queue_purge(struct sock *sk)
 	INIT_LIST_HEAD(&tcp_sk(sk)->tsorted_sent_queue);
 	sk_mem_reclaim(sk);
 	tcp_clear_all_retrans_hints(tcp_sk(sk));
+	tcp_sk(sk)->packets_out = 0;
 }
 
 int tcp_disconnect(struct sock *sk, int flags)

@@ -2417,7 +2418,6 @@ int tcp_disconnect(struct sock *sk, int flags)
 	icsk->icsk_backoff = 0;
 	tp->snd_cwnd = 2;
 	icsk->icsk_probes_out = 0;
-	tp->packets_out = 0;
 	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
 	tp->snd_cwnd_cnt = 0;
 	tp->window_clamp = 0;
Signature · 1 line
2.17.0.484.g0c8726318c-goog
maintainer
#1 lore raw

From: Soheil Hassas Yeganeh <[email protected]>
Date: Sat, 14 Apr 2018 20:44:46 -0400

Quoted 10 lines

From: Soheil Hassas Yeganeh <[email protected]>

Clear tp->packets_out when purging the write queue, otherwise tcp_rearm_rto() mistakenly assumes TCP write queue is not empty. This results in NULL pointer dereference.

Also, remove the redundant tp->packets_out = 0 from tcp_disconnect(), since tcp_disconnect() calls tcp_write_queue_purge().

Quoted 8 lines
Fixes a27fd7a8ed38 (tcp: purge write queue upon RST)
Reported-by Subash Abhinov Kasiviswanathan <[email protected]>
Reported-by Sami Farin <[email protected]>
Tested-by Sami Farin <[email protected]>
Signed-off-by Eric Dumazet <[email protected]>
Signed-off-by Soheil Hassas Yeganeh <[email protected]>
Acked-by Yuchung Cheng <[email protected]>
Acked-by Neal Cardwell <[email protected]>

Applied and queued up for -stable, thanks.