linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Christoph Paasch <cpaasch@apple.com>
To: Tim Froidcoeur <tim.froidcoeur@tessares.net>
Cc: matthieu.baerts@tessares.net, aprout@ll.mit.edu,
	davem@davemloft.net, edumazet@google.com,
	gregkh@linuxfoundation.org, jonathan.lemon@gmail.com,
	jtl@netflix.com, linux-kernel@vger.kernel.org, mkubecek@suse.cz,
	ncardwell@google.com, sashal@kernel.org, stable@vger.kernel.org,
	ycheng@google.com
Subject: Re: [PATCH] tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
Date: Fri, 23 Aug 2019 09:56:47 -0700	[thread overview]
Message-ID: <20190823165647.GJ5994@MacBook-Pro-64.local> (raw)
In-Reply-To: <20190823125054.30070-1-tim.froidcoeur@tessares.net>

On 23/08/19 - 14:50:54, Tim Froidcoeur wrote:
> Commit 8c3088f895a0 ("tcp: be more careful in tcp_fragment()")
> triggers following stack trace:
> 
> [25244.848046] kernel BUG at ./include/linux/skbuff.h:1406!
> [25244.859335] RIP: 0010:skb_queue_prev+0x9/0xc
> [25244.888167] Call Trace:
> [25244.889182]  <IRQ>
> [25244.890001]  tcp_fragment+0x9c/0x2cf
> [25244.891295]  tcp_write_xmit+0x68f/0x988
> [25244.892732]  __tcp_push_pending_frames+0x3b/0xa0
> [25244.894347]  tcp_data_snd_check+0x2a/0xc8
> [25244.895775]  tcp_rcv_established+0x2a8/0x30d
> [25244.897282]  tcp_v4_do_rcv+0xb2/0x158
> [25244.898666]  tcp_v4_rcv+0x692/0x956
> [25244.899959]  ip_local_deliver_finish+0xeb/0x169
> [25244.901547]  __netif_receive_skb_core+0x51c/0x582
> [25244.903193]  ? inet_gro_receive+0x239/0x247
> [25244.904756]  netif_receive_skb_internal+0xab/0xc6
> [25244.906395]  napi_gro_receive+0x8a/0xc0
> [25244.907760]  receive_buf+0x9a1/0x9cd
> [25244.909160]  ? load_balance+0x17a/0x7b7
> [25244.910536]  ? vring_unmap_one+0x18/0x61
> [25244.911932]  ? detach_buf+0x60/0xfa
> [25244.913234]  virtnet_poll+0x128/0x1e1
> [25244.914607]  net_rx_action+0x12a/0x2b1
> [25244.915953]  __do_softirq+0x11c/0x26b
> [25244.917269]  ? handle_irq_event+0x44/0x56
> [25244.918695]  irq_exit+0x61/0xa0
> [25244.919947]  do_IRQ+0x9d/0xbb
> [25244.921065]  common_interrupt+0x85/0x85
> [25244.922479]  </IRQ>
> 
> tcp_rtx_queue_tail() (called by tcp_fragment()) can call
> tcp_write_queue_prev() on the first packet in the queue, which will trigger
> the BUG in tcp_write_queue_prev(), because there is no previous packet.
> 
> This happens when the retransmit queue is empty, for example in case of a
> zero window.
> 
> Patch is needed for 4.4, 4.9 and 4.14 stable branches.
> 
> Fixes: 8c3088f895a0 ("tcp: be more careful in tcp_fragment()")
> Signed-off-by: Tim Froidcoeur <tim.froidcoeur@tessares.net>
> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
> ---
>  include/net/tcp.h | 4 ++++
>  1 file changed, 4 insertions(+)

Reviewed-by: Christoph Paasch <cpaasch@apple.com>


  reply	other threads:[~2019-08-23 20:52 UTC|newest]

Thread overview: 52+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-08 19:05 [PATCH 4.14 00/33] 4.14.138-stable review Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 01/33] scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 02/33] ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD SOM-LV Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 03/33] ARM: dts: Add pinmuxing for i2c2 and i2c3 for LogicPD torpedo Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 04/33] tcp: be more careful in tcp_fragment() Greg Kroah-Hartman
2019-08-20 16:45   ` Matthieu Baerts
2019-08-23 12:50     ` [PATCH] tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue Tim Froidcoeur
2019-08-23 16:56       ` Christoph Paasch [this message]
2019-08-23 21:46       ` David Miller
2019-08-24  6:03     ` [PATCH 4.14] " Tim Froidcoeur
2019-08-24 22:05       ` Jonathan Lemon
2019-08-30 23:26         ` Christoph Paasch
2019-08-31  2:20           ` David Miller
2019-08-31 10:53             ` maowenan
2019-08-31 11:44             ` maowenan
     [not found]               ` <CAOj+RUsqTUF9fuetskRRw26Z=sBM-mELSMcV21Ch06007aP5yQ@mail.gmail.com>
     [not found]                 ` <F95AC9340317A84688A5F0DF0246F3F21AAB8F82@dggeml512-mbx.china.huawei.com>
2019-09-03  6:58                   ` Tim Froidcoeur
2019-09-03  8:55                     ` maowenan
2019-08-31 12:20       ` Sasha Levin
2019-08-31 13:14         ` Matthieu Baerts
2019-09-01  0:07           ` Sasha Levin
2019-08-08 19:05 ` [PATCH 4.14 05/33] arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 06/33] HID: wacom: fix bit shift for Cintiq Companion 2 Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 07/33] HID: Add quirk for HP X1200 PIXART OEM mouse Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 08/33] RDMA: Directly cast the sockaddr union to sockaddr Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 09/33] [PATCH] IB: directly cast the sockaddr union to aockaddr Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 10/33] objtool: Add machine_real_restart() to the noreturn list Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 11/33] objtool: Add rewind_stack_do_exit() " Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 12/33] atm: iphase: Fix Spectre v1 vulnerability Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 13/33] ife: error out when nla attributes are empty Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 14/33] ip6_tunnel: fix possible use-after-free on xmit Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 15/33] net: bridge: delete local fdb on device init failure Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 16/33] net: bridge: mcast: dont delete permanent entries when fast leave is enabled Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 17/33] net: fix ifindex collision during namespace removal Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 18/33] net/mlx5: Use reversed order when unregister devices Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 19/33] net: phylink: Fix flow control for fixed-link Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 20/33] net: sched: Fix a possible null-pointer dereference in dequeue_func() Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 21/33] NFC: nfcmrvl: fix gpio-handling regression Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 22/33] tipc: compat: allow tipc commands without arguments Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 23/33] compat_ioctl: pppoe: fix PPPOEIOCSFWD handling Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 24/33] net/mlx5e: Prevent encap flow counter update async to user query Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 25/33] tun: mark small packets as owned by the tap sock Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 26/33] mvpp2: refactor MTU change code Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 27/33] bnx2x: Disable multi-cos feature Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 28/33] cgroup: Call cgroup_release() before __exit_signal() Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 29/33] cgroup: Implement css_task_iter_skip() Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 30/33] cgroup: Include dying leaders with live threads in PROCS iterations Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 31/33] cgroup: css_task_iter_skip()d iterators must be advanced before accessed Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 32/33] cgroup: Fix css_task_iter_advance_css_set() cset skip condition Greg Kroah-Hartman
2019-08-08 19:05 ` [PATCH 4.14 33/33] spi: bcm2835: Fix 3-wire mode if DMA is enabled Greg Kroah-Hartman
2019-08-09  0:41 ` [PATCH 4.14 00/33] 4.14.138-stable review shuah
2019-08-09  3:16 ` Naresh Kamboju
2019-08-09 15:36 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190823165647.GJ5994@MacBook-Pro-64.local \
    --to=cpaasch@apple.com \
    --cc=aprout@ll.mit.edu \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=jonathan.lemon@gmail.com \
    --cc=jtl@netflix.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=matthieu.baerts@tessares.net \
    --cc=mkubecek@suse.cz \
    --cc=ncardwell@google.com \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tim.froidcoeur@tessares.net \
    --cc=ycheng@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).