diff options
| author |   Yuchung Cheng <ycheng@google.com> | 2018-12-05 14:38:38 -0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-12-05 16:34:40 -0800 |
| commit | b2b7af861122a0c0f6260155c29a1b2e594cd5b5 (patch) | |
| tree | e50108978bd22380b6d831725c8998bdd2a797d7 /net/ipv4/ip_fragment.c | |
| parent | tcp: Do not underestimate rwnd_limited (diff) | |
| download | linux-dev-b2b7af861122a0c0f6260155c29a1b2e594cd5b5.tar.xz linux-dev-b2b7af861122a0c0f6260155c29a1b2e594cd5b5.zip | |
tcp: fix NULL ref in tail loss probe
TCP loss probe timer may fire when the retranmission queue is empty but
has a non-zero tp->packets_out counter. tcp_send_loss_probe will call
tcp_rearm_rto which triggers NULL pointer reference by fetching the
retranmission queue head in its sub-routines.
Add a more detailed warning to help catch the root cause of the inflight
accounting inconsistency.
Reported-by: Rafael Tinoco <rafael.tinoco@linaro.org>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/ip_fragment.c')
0 files changed, 0 insertions, 0 deletions