@@ -1357,6 +1357,10 @@ static inline void tcp_insert_write_queue_before(struct sk_buff *new,
static inline void tcp_unlink_write_queue(struct sk_buff *skb, struct sock *sk)
{
+ WARN_ON(skb == tcp_sk(sk)->retransmit_skb_hint);
+ WARN_ON(skb == tcp_sk(sk)->lost_skb_hint);
+ WARN_ON(skb == tcp_sk(sk)->scoreboard_skb_hint);
+ WARN_ON(skb == sk->sk_send_head);
__skb_unlink(skb, &sk->sk_write_queue);
}
@@ -1102,11 +1102,11 @@ out:
do_fault:
if (!skb->len) {
- tcp_unlink_write_queue(skb, sk);
/* It is the one place in all of TCP, except connection
* reset, where we can be unlinking the send_head.
*/
tcp_check_send_head(sk, skb);
+ tcp_unlink_write_queue(skb, sk);
sk_wmem_free_skb(sk, skb);
}
@@ -3251,13 +3251,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
if (!fully_acked)
break;
- tcp_unlink_write_queue(skb, sk);
- sk_wmem_free_skb(sk, skb);
tp->scoreboard_skb_hint = NULL;
if (skb == tp->retransmit_skb_hint)
tp->retransmit_skb_hint = NULL;
if (skb == tp->lost_skb_hint)
tp->lost_skb_hint = NULL;
+ tcp_unlink_write_queue(skb, sk);
+ sk_wmem_free_skb(sk, skb);
}
if (likely(between(tp->snd_up, prior_snd_una, tp->snd_una)))
@@ -1791,6 +1791,10 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
tcp_highest_sack_combine(sk, next_skb, skb);
+ /* changed transmit queue under us so clear hints */
+ tcp_clear_retrans_hints_partial(tp);
+ if (next_skb == tp->retransmit_skb_hint)
+ tp->retransmit_skb_hint = skb;
tcp_unlink_write_queue(next_skb, sk);
skb_copy_from_linear_data(next_skb, skb_put(skb, next_skb_size),
@@ -1813,10 +1817,6 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
*/
TCP_SKB_CB(skb)->sacked |= TCP_SKB_CB(next_skb)->sacked & TCPCB_EVER_RETRANS;
- /* changed transmit queue under us so clear hints */
- tcp_clear_retrans_hints_partial(tp);
- if (next_skb == tp->retransmit_skb_hint)
- tp->retransmit_skb_hint = skb;
tcp_adjust_pcount(sk, next_skb, tcp_skb_pcount(next_skb));