Commit 1b3c393c authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 

Pull networking fixes from David Miller:
 "Two stragglers:

   1) The new code that adds new flushing semantics to GRO can cause SKB
      pointer list corruption, manage the lists differently to avoid the
      OOPS.  Fix from Eric Dumazet.

   2) When TCP fast open does a retransmit of data in a SYN-ACK or
      similar, we update retransmit state that we shouldn't triggering a
      WARN_ON later.  Fix from Yuchung Cheng."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  net: gro: fix possible panic in skb_gro_receive()
  tcp: bug fix Fast Open client retransmission
parents 1afa4717 c3c7c254

include/linux/netdevice.h

+3 −0
Original line number Diff line number Diff line
@@ -1488,6 +1488,9 @@ struct napi_gro_cb { 


	/* Used in ipv6_gro_receive() */

	int	proto;



	/* used in skb_gro_receive() slow path */

	struct sk_buff *last;

};



#define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb)

include/net/tcp.h

+1 −0
Original line number Diff line number Diff line
@@ -525,6 +525,7 @@ static inline __u32 cookie_v6_init_sequence(struct sock *sk, 
extern void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,

				      int nonagle);

extern bool tcp_may_send_now(struct sock *sk);

extern int __tcp_retransmit_skb(struct sock *, struct sk_buff *);

extern int tcp_retransmit_skb(struct sock *, struct sk_buff *);

extern void tcp_retransmit_timer(struct sock *sk);

extern void tcp_xmit_retransmit_queue(struct sock *);

net/core/dev.c

+2 −0
Original line number Diff line number Diff line
@@ -3451,6 +3451,8 @@ static int napi_gro_complete(struct sk_buff *skb) 
	struct list_head *head = &ptype_base[ntohs(type) & PTYPE_HASH_MASK];

	int err = -ENOENT;



	BUILD_BUG_ON(sizeof(struct napi_gro_cb) > sizeof(skb->cb));



	if (NAPI_GRO_CB(skb)->count == 1) {

		skb_shinfo(skb)->gso_size = 0;

		goto out;

net/core/skbuff.c

+3 −3
Original line number Diff line number Diff line
@@ -3004,7 +3004,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb) 
	skb_shinfo(nskb)->gso_size = pinfo->gso_size;

	pinfo->gso_size = 0;

	skb_header_release(p);

	nskb->prev = p;

	NAPI_GRO_CB(nskb)->last = p;



	nskb->data_len += p->len;

	nskb->truesize += p->truesize;
@@ -3030,8 +3030,8 @@ merge: 


	__skb_pull(skb, offset);



	p->prev->next = skb;

	p->prev = skb;

	NAPI_GRO_CB(p)->last->next = skb;

	NAPI_GRO_CB(p)->last = skb;

	skb_header_release(skb);



done:

net/ipv4/tcp_input.c

+5 −1
Original line number Diff line number Diff line
@@ -5645,7 +5645,11 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack, 
	tcp_fastopen_cache_set(sk, mss, cookie, syn_drop);



	if (data) { /* Retransmit unacked data in SYN */

		tcp_retransmit_skb(sk, data);

		tcp_for_write_queue_from(data, sk) {

			if (data == tcp_send_head(sk) ||

			    __tcp_retransmit_skb(sk, data))

				break;

		}

		tcp_rearm_rto(sk);

		return true;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE