diff options
| author |   Paolo Abeni <pabeni@redhat.com> | 2020-11-18 23:05:34 +0100 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2020-11-19 21:54:24 -0800 |
| commit | b680a214ec281dbd44b5ebbf3f126a57f1ecf0f7 (patch) | |
| tree | 8bbd114bccb17adb18a9fc0e08beb29af36c7827 /net | |
| parent | Merge branch 'devlink-move-common-flash_update-calls-to-core' (diff) | |
| download | linux-dev-b680a214ec281dbd44b5ebbf3f126a57f1ecf0f7.tar.xz linux-dev-b680a214ec281dbd44b5ebbf3f126a57f1ecf0f7.zip | |
mptcp: update rtx timeout only if required.
We must start the retransmission timer only there are
pending data in the rtx queue.
Otherwise we can hit a WARN_ON in mptcp_reset_timer(),
as syzbot demonstrated.
Reported-and-tested-by: syzbot+42aa53dafb66a07e5a24@syzkaller.appspotmail.com
Fixes: d9ca1de8c0cd ("mptcp: move page frag allocation in mptcp_sendmsg()")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Link: https://lore.kernel.org/r/1a72039f112cae048c44d398ffa14e0a1432db3d.1605737083.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mptcp/protocol.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 8df013daea88..aeda4357de9a 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1261,11 +1261,12 @@ static void mptcp_push_pending(struct sock *sk, unsigned int flags) mptcp_push_release(sk, ssk, &info); out: - /* start the timer, if it's not pending */ - if (!mptcp_timer_pending(sk)) - mptcp_reset_timer(sk); - if (copied) + if (copied) { + /* start the timer, if it's not pending */ + if (!mptcp_timer_pending(sk)) + mptcp_reset_timer(sk); __mptcp_check_send_data_fin(sk); + } } static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) |