Skip to contentSkip to conversation

tcp: clear tp->packets_out when purging write queue

PATCH New Soheil Hassas Yeganeh 1 participant 1 message Apr 15, 2018

Subsystems (3)
Networking Network drivers TCP
lore
Share & tools
lore

Soheil Hassas Yeganeh

author
#0 lore raw

PATCH 1/1 tcp: clear tp->packets_out when purging write queue

From: Soheil Hassas Yeganeh <[email protected]>

Clear tp->packets_out when purging the write queue, otherwise tcp_rearm_rto() mistakenly assumes TCP write queue is not empty. This results in NULL pointer dereference.

Also, remove the redundant tp->packets_out = 0 from tcp_disconnect(), since tcp_disconnect() calls tcp_write_queue_purge().

Fixes a27fd7a8ed38 (tcp: purge write queue upon RST)
Reported-by Subash Abhinov Kasiviswanathan <[email protected]>
Reported-by Sami Farin <[email protected]>
Tested-by Sami Farin <[email protected]>
Signed-off-by Eric Dumazet <[email protected]>
Signed-off-by Soheil Hassas Yeganeh <[email protected]>
Acked-by Yuchung Cheng <[email protected]>
Acked-by Neal Cardwell <[email protected]>
---
 include/net/tcp.h | 1 +
 net/ipv4/tcp.c    | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)
include/net/tcp.h +1 -0
index d323d4fa742ca..fb653736f3353 100644
@@ -1616,6 +1616,7 @@ static inline void tcp_write_queue_purge(struct sock *sk)
 	sk_mem_reclaim(sk);
 	tcp_clear_all_retrans_hints(tcp_sk(sk));
 	tcp_init_send_head(sk);
+	tcp_sk(sk)->packets_out = 0;
 }
 
 static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk)
net/ipv4/tcp.c +0 -1
index 38b9a6276a9de..4dda8d301802e 100644
@@ -2354,7 +2354,6 @@ int tcp_disconnect(struct sock *sk, int flags)
 	icsk->icsk_backoff = 0;
 	tp->snd_cwnd = 2;
 	icsk->icsk_probes_out = 0;
-	tp->packets_out = 0;
 	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
 	tp->snd_cwnd_cnt = 0;
 	tp->window_clamp = 0;
Signature · 1 line
2.17.0.484.g0c8726318c-goog