Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 122e4a30 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

tcp: tcp_v4_err() should be more careful 



[ Upstream commit 2c4cc9712364c051b1de2d175d5fbea6be948ebf ]

ICMP handlers are not very often stressed, we should
make them more resilient to bugs that might surface in
the future.

If there is no packet in retransmit queue, we should
avoid a NULL deref.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarsoukjin bae <soukjin.bae@samsung.com>
Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 817d4a42

net/ipv4/tcp_ipv4.c

+4 −3
Original line number Diff line number Diff line
@@ -466,14 +466,15 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) 
		if (sock_owned_by_user(sk))

			break;



		skb = tcp_write_queue_head(sk);

		if (WARN_ON_ONCE(!skb))

			break;



		icsk->icsk_backoff--;

		icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) :

					       TCP_TIMEOUT_INIT;

		icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);



		skb = tcp_write_queue_head(sk);

		BUG_ON(!skb);



		remaining = icsk->icsk_rto -

			    min(icsk->icsk_rto,

				tcp_time_stamp - tcp_skb_timestamp(skb));