Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e09c6a4e authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'tcp-fix-possible-crash-in-tcp_v4_err' 



Eric Dumazet says:

====================
tcp: fix possible crash in tcp_v4_err()

soukjin bae reported a crash in tcp_v4_err() that we
root caused to a missing initialization.

Second patch adds a sanity check in tcp_v4_err() to avoid
future potential problems. Ignoring an ICMP message
is probably better than crashing a machine.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents e928b5d6 2c4cc971

net/ipv4/tcp.c

+1 −1
Original line number Diff line number Diff line
@@ -2528,6 +2528,7 @@ void tcp_write_queue_purge(struct sock *sk) 
	sk_mem_reclaim(sk);

	tcp_clear_all_retrans_hints(tcp_sk(sk));

	tcp_sk(sk)->packets_out = 0;

	inet_csk(sk)->icsk_backoff = 0;

}



int tcp_disconnect(struct sock *sk, int flags)
@@ -2576,7 +2577,6 @@ int tcp_disconnect(struct sock *sk, int flags) 
	tp->write_seq += tp->max_window + 2;

	if (tp->write_seq == 0)

		tp->write_seq = 1;

	icsk->icsk_backoff = 0;

	tp->snd_cwnd = 2;

	icsk->icsk_probes_out = 0;

	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;

net/ipv4/tcp_ipv4.c

+4 −1
Original line number Diff line number Diff line
@@ -536,12 +536,15 @@ int tcp_v4_err(struct sk_buff *icmp_skb, u32 info) 
		if (sock_owned_by_user(sk))

			break;



		skb = tcp_rtx_queue_head(sk);

		if (WARN_ON_ONCE(!skb))

			break;



		icsk->icsk_backoff--;

		icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) :

					       TCP_TIMEOUT_INIT;

		icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);



		skb = tcp_rtx_queue_head(sk);



		tcp_mstamp_refresh(tp);

		delta_us = (u32)(tp->tcp_mstamp - tcp_skb_timestamp_us(skb));