Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e421410 authored Nov 19, 2007 by Ilpo Jrvinen Committed by David S. Miller Nov 19, 2007

[TCP] MTUprobe: fix potential sk_send_head corruption



When the abstraction functions got added, conversion here was
made incorrectly. As a result, the skb may end up pointing
to skb which got included to the probe skb and then was freed.
For it to trigger, however, skb_transmit must fail sending as
well.

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 1f8170b0

include/net/tcp.h

+3 −0

Original line number	Diff line number	Diff line
		@@ -1288,6 +1288,9 @@ static inline void tcp_insert_write_queue_before(struct sk_buff *new,
		struct sock *sk)
		{
		__skb_insert(new, skb->prev, skb, &sk->sk_write_queue);

		if (sk->sk_send_head == skb)
		sk->sk_send_head = new;
		}

		static inline void tcp_unlink_write_queue(struct sk_buff skb, struct sock sk)

net/ipv4/tcp_output.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -1352,7 +1352,6 @@ static int tcp_mtu_probe(struct sock *sk)

		skb = tcp_send_head(sk);
		tcp_insert_write_queue_before(nskb, skb, sk);
		tcp_advance_send_head(sk, skb);

		TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
		TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;