diff options
| author | Soheil Hassas Yeganeh <soheil@google.com> | 2018-04-14 20:44:46 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-04-29 11:35:46 +0200 |
| commit | d9cae9043bb368e105aaa8ba10abc8954d6c5ad6 (patch) | |
| tree | 9432654e7d64d171a273b322f3f8e5d655dd5914 | |
| parent | 1fcaef8489ac727ef4dffacf9034d2fd3ad6f545 (diff) | |
| download | linux-stable-d9cae9043bb368e105aaa8ba10abc8954d6c5ad6.tar.gz linux-stable-d9cae9043bb368e105aaa8ba10abc8954d6c5ad6.tar.bz2 linux-stable-d9cae9043bb368e105aaa8ba10abc8954d6c5ad6.zip | |
tcp: clear tp->packets_out when purging write queue
[ Upstream commit bffd168c3fc5cc7d2bad4c668fa90e7a9010db4b ]
Clear tp->packets_out when purging the write queue, otherwise
tcp_rearm_rto() mistakenly assumes TCP write queue is not empty.
This results in NULL pointer dereference.
Also, remove the redundant `tp->packets_out = 0` from
tcp_disconnect(), since tcp_disconnect() calls
tcp_write_queue_purge().
Fixes: a27fd7a8ed38 (tcp: purge write queue upon RST)
Reported-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Reported-by: Sami Farin <hvtaifwkbgefbaei@gmail.com>
Tested-by: Sami Farin <hvtaifwkbgefbaei@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/ipv4/tcp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 8b8059b7af4d..bb48cd142b92 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2385,6 +2385,7 @@ void tcp_write_queue_purge(struct sock *sk) INIT_LIST_HEAD(&tcp_sk(sk)->tsorted_sent_queue); sk_mem_reclaim(sk); tcp_clear_all_retrans_hints(tcp_sk(sk)); + tcp_sk(sk)->packets_out = 0; } int tcp_disconnect(struct sock *sk, int flags) @@ -2434,7 +2435,6 @@ int tcp_disconnect(struct sock *sk, int flags) icsk->icsk_backoff = 0; tp->snd_cwnd = 2; icsk->icsk_probes_out = 0; - tp->packets_out = 0; tp->snd_ssthresh = TCP_INFINITE_SSTHRESH; tp->snd_cwnd_cnt = 0; tp->window_clamp = 0; |