diff options
| author | David S. Miller <davem@davemloft.net> | 2019-02-17 15:46:59 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-02-17 15:46:59 -0800 |
| commit | e09c6a4ec1bb9ed73b4157b69c261e408d875b0f (patch) | |
| tree | 26a96c9f5c6762780a5941fddcb326eb8a555449 /net/ipv4/tcp_ipv4.c | |
| parent | e928b5d6b75e239feb9c6d5488974b6646a0ebc8 (diff) | |
| parent | 2c4cc9712364c051b1de2d175d5fbea6be948ebf (diff) | |
Merge branch 'tcp-fix-possible-crash-in-tcp_v4_err'
Eric Dumazet says:
====================
tcp: fix possible crash in tcp_v4_err()
soukjin bae reported a crash in tcp_v4_err() that we
root caused to a missing initialization.
Second patch adds a sanity check in tcp_v4_err() to avoid
future potential problems. Ignoring an ICMP message
is probably better than crashing a machine.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_ipv4.c')
| -rw-r--r-- | net/ipv4/tcp_ipv4.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index efc6fef692ff..ec3cea9d6828 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -536,12 +536,15 @@ int tcp_v4_err(struct sk_buff *icmp_skb, u32 info) if (sock_owned_by_user(sk)) break; + skb = tcp_rtx_queue_head(sk); + if (WARN_ON_ONCE(!skb)) + break; + icsk->icsk_backoff--; icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) : TCP_TIMEOUT_INIT; icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX); - skb = tcp_rtx_queue_head(sk); tcp_mstamp_refresh(tp); delta_us = (u32)(tp->tcp_mstamp - tcp_skb_timestamp_us(skb)); |