diff options
| author | Yuchung Cheng <ycheng@google.com> | 2018-12-05 14:38:38 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-12-05 16:34:40 -0800 |
| commit | b2b7af861122a0c0f6260155c29a1b2e594cd5b5 (patch) | |
| tree | e50108978bd22380b6d831725c8998bdd2a797d7 /net/ipv4/raw.c | |
| parent | 41727549de3e7281feb174d568c6e46823db8684 (diff) | |
| download | linux-stable-b2b7af861122a0c0f6260155c29a1b2e594cd5b5.tar.gz linux-stable-b2b7af861122a0c0f6260155c29a1b2e594cd5b5.tar.bz2 linux-stable-b2b7af861122a0c0f6260155c29a1b2e594cd5b5.zip | |
tcp: fix NULL ref in tail loss probe
TCP loss probe timer may fire when the retranmission queue is empty but
has a non-zero tp->packets_out counter. tcp_send_loss_probe will call
tcp_rearm_rto which triggers NULL pointer reference by fetching the
retranmission queue head in its sub-routines.
Add a more detailed warning to help catch the root cause of the inflight
accounting inconsistency.
Reported-by: Rafael Tinoco <rafael.tinoco@linaro.org>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/raw.c')
0 files changed, 0 insertions, 0 deletions