From patchwork Fri Nov 3 01:10:03 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 833603 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="MWrUlghb"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3ySkQV4gvHz9sBd for ; Fri, 3 Nov 2017 12:10:10 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934703AbdKCBKG (ORCPT ); Thu, 2 Nov 2017 21:10:06 -0400 Received: from mail-pg0-f68.google.com ([74.125.83.68]:55023 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932657AbdKCBKF (ORCPT ); Thu, 2 Nov 2017 21:10:05 -0400 Received: by mail-pg0-f68.google.com with SMTP id l24so1107369pgu.11 for ; Thu, 02 Nov 2017 18:10:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=STc1aCiMAskF/pWdvVG481b4UCuJdocDApVEQZ6N5iY=; b=MWrUlghbu5vr3mu/YHXz+7TjpezBqIZMVe+KrlbVK8USrGZTr6NyLDDiUjrsapqCVS 1UnYRZtnHrG4BBqoZ9NpzcR3oOgDB8UU3Immf3KKKDq1Q98RvJgMd/RPcgNvJxFd9ZT0 nVd9E8TiEsh5d8sp6GmL6acsQ0DngJrxBdlyS8tvmBrHqKtNNNDPMZj6kXX0Mqocd8Uv aVg9cpS6zeVIbJvFehIzKEzwimDqKlqQRneHMGuSJxe/9xZfg+AKMmHYp20PndH2DCnn 1dbU+wDxRv7UvsdlLxDQD8mcDEgG8s6tRQOwwDv0jHETwPZo1SjorN+xPmguKuLtTht7 EW5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=STc1aCiMAskF/pWdvVG481b4UCuJdocDApVEQZ6N5iY=; b=tysRQcVjqkkZOmL3X0v82QDI2z69fMSBqCgMhNU/ZuuxDg2sJvVvVrtD5OgGihNLpd ofke1fk2Yo6LZpZW6+ZfY8bvhmORDSrBjfS8EWYTKfuJWqWrc2K1m0O78ftlPplAG/JT 45iZvQreZ4I/9sQ+VrhCe1BSasQMSswTuy98bZ7TXCBDplOguBOnupK+IWe8rqGcQnNi PL8t+7q72A4DfRFFC7zJaiGNV2/9ZF5w1xVGEHKiT+Rc12gEwiyjJMLcL4JEz7HI1FXX K/1xSm/ITdWAWIKwNoBxtejglL7lUofNmPAm751cLjPOtHHUueMO4q1/+TUrx+aZ6KEM RWXA== X-Gm-Message-State: AMCzsaU2EGg4znO2L1ys4fLuZ2BQUBaS5tNhfp1iBiicrqUcvwQ7gKja 8cftaRp/eE3lKT3WVVfdHCY= X-Google-Smtp-Source: ABhQp+QNr2mBeKgGv/Xe50XH+KzI5dZlXVKgMt+HaH2q8khggbfLV4PeXKtz+RCVkUwN1MXWq+okwg== X-Received: by 10.159.206.199 with SMTP id x7mr5118823plo.342.1509671405155; Thu, 02 Nov 2017 18:10:05 -0700 (PDT) Received: from [192.168.86.171] (c-67-180-167-114.hsd1.ca.comcast.net. [67.180.167.114]) by smtp.googlemail.com with ESMTPSA id r77sm9197263pfk.93.2017.11.02.18.10.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 02 Nov 2017 18:10:04 -0700 (PDT) Message-ID: <1509671403.2849.38.camel@edumazet-glaptop3.roam.corp.google.com> Subject: [PATCH net-next] tcp: tcp_fragment() should not assume rtx skbs From: Eric Dumazet To: David Miller Cc: netdev , Yuchung Cheng , Neal Cardwell , Soheil Hassas Yeganeh , Alexei Starovoitov , Priyaranjan Jha Date: Thu, 02 Nov 2017 18:10:03 -0700 X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Eric Dumazet While stress testing MTU probing, we had crashes in list_del() that we root-caused to the fact that tcp_fragment() is unconditionally inserting the freshly allocated skb into tsorted_sent_queue list. But this list is supposed to contain skbs that were sent. This was mostly harmless until MTU probing was enabled. Fortunately we can use the tcp_queue enum added later (but in same linux version) for rtx-rb-tree to fix the bug. Fixes: e2080072ed2d ("tcp: new list for sent but unacked skbs for RACK recovery") Signed-off-by: Eric Dumazet Cc: Yuchung Cheng Cc: Neal Cardwell Cc: Soheil Hassas Yeganeh Cc: Alexei Starovoitov Cc: Priyaranjan Jha Acked-by: Neal Cardwell Acked-by: Soheil Hassas Yeganeh --- net/ipv4/tcp_output.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index a85e8a282d173983e35a2a1e3135ca2a63f1699e..36a3e7c909caacd981b84d1d8820a33d922f5a4e 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1395,7 +1395,8 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue, /* Link BUFF into the send queue. */ __skb_header_release(buff); tcp_insert_write_queue_after(skb, buff, sk, tcp_queue); - list_add(&buff->tcp_tsorted_anchor, &skb->tcp_tsorted_anchor); + if (tcp_queue == TCP_FRAG_IN_RTX_QUEUE) + list_add(&buff->tcp_tsorted_anchor, &skb->tcp_tsorted_anchor); return 0; }