Commit 2c4cc971 authored Feb 15, 2019 by Eric Dumazet Committed by David S. Miller Feb 17, 2019

tcp: tcp_v4_err() should be more careful



ICMP handlers are not very often stressed, we should
make them more resilient to bugs that might surface in
the future.

If there is no packet in retransmit queue, we should
avoid a NULL deref.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: soukjin bae <soukjin.bae@samsung.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 04c03114

net/ipv4/tcp_ipv4.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -536,12 +536,15 @@ int tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
		if (sock_owned_by_user(sk))
		break;

		skb = tcp_rtx_queue_head(sk);
		if (WARN_ON_ONCE(!skb))
		break;

		icsk->icsk_backoff--;
		icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) :
		TCP_TIMEOUT_INIT;
		icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);

		skb = tcp_rtx_queue_head(sk);

		tcp_mstamp_refresh(tp);
		delta_us = (u32)(tp->tcp_mstamp - tcp_skb_timestamp_us(skb));

Admin message