Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:
"Two stragglers:
1) The new code that adds new flushing semantics to GRO can cause SKB
pointer list corruption, manage the lists differently to avoid the
OOPS. Fix from Eric Dumazet.
2) When TCP fast open does a retransmit of data in a SYN-ACK or
similar, we update retransmit state that we shouldn't triggering a
WARN_ON later. Fix from Yuchung Cheng."
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
net: gro: fix possible panic in skb_gro_receive()
tcp: bug fix Fast Open client retransmission
+24
-9
+3
include/linux/netdevice.h
+3
include/linux/netdevice.h
+1
include/net/tcp.h
+1
include/net/tcp.h
···
525
525
extern void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
526
526
int nonagle);
527
527
extern bool tcp_may_send_now(struct sock *sk);
528
+
extern int __tcp_retransmit_skb(struct sock *, struct sk_buff *);
528
529
extern int tcp_retransmit_skb(struct sock *, struct sk_buff *);
529
530
extern void tcp_retransmit_timer(struct sock *sk);
530
531
extern void tcp_xmit_retransmit_queue(struct sock *);
+2
net/core/dev.c
+2
net/core/dev.c
···
3451
3451
struct list_head *head = &ptype_base[ntohs(type) & PTYPE_HASH_MASK];
3452
3452
int err = -ENOENT;
3453
3453
3454
+
BUILD_BUG_ON(sizeof(struct napi_gro_cb) > sizeof(skb->cb));
3455
+
3454
3456
if (NAPI_GRO_CB(skb)->count == 1) {
3455
3457
skb_shinfo(skb)->gso_size = 0;
3456
3458
goto out;
+3
-3
net/core/skbuff.c
+3
-3
net/core/skbuff.c
···
3004
3004
skb_shinfo(nskb)->gso_size = pinfo->gso_size;
3005
3005
pinfo->gso_size = 0;
3006
3006
skb_header_release(p);
3007
-
nskb->prev = p;
3007
+
NAPI_GRO_CB(nskb)->last = p;
3008
3008
3009
3009
nskb->data_len += p->len;
3010
3010
nskb->truesize += p->truesize;
···
3030
3030
3031
3031
__skb_pull(skb, offset);
3032
3032
3033
-
p->prev->next = skb;
3034
-
p->prev = skb;
3033
+
NAPI_GRO_CB(p)->last->next = skb;
3034
+
NAPI_GRO_CB(p)->last = skb;
3035
3035
skb_header_release(skb);
3036
3036
3037
3037
done:
+5
-1
net/ipv4/tcp_input.c
+5
-1
net/ipv4/tcp_input.c
···
5645
5645
tcp_fastopen_cache_set(sk, mss, cookie, syn_drop);
5646
5646
5647
5647
if (data) { /* Retransmit unacked data in SYN */
5648
-
tcp_retransmit_skb(sk, data);
5648
+
tcp_for_write_queue_from(data, sk) {
5649
+
if (data == tcp_send_head(sk) ||
5650
+
__tcp_retransmit_skb(sk, data))
5651
+
break;
5652
+
}
5649
5653
tcp_rearm_rto(sk);
5650
5654
return true;
5651
5655
}
+10
-5
net/ipv4/tcp_output.c
+10
-5
net/ipv4/tcp_output.c
···
2309
2309
* state updates are done by the caller. Returns non-zero if an
2310
2310
* error occurred which prevented the send.
2311
2311
*/
2312
-
int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
2312
+
int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
2313
2313
{
2314
2314
struct tcp_sock *tp = tcp_sk(sk);
2315
2315
struct inet_connection_sock *icsk = inet_csk(sk);
2316
2316
unsigned int cur_mss;
2317
-
int err;
2318
2317
2319
2318
/* Inconslusive MTU probe */
2320
2319
if (icsk->icsk_mtup.probe_size) {
···
2386
2387
if (unlikely(NET_IP_ALIGN && ((unsigned long)skb->data & 3))) {
2387
2388
struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
2388
2389
GFP_ATOMIC);
2389
-
err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
2390
-
-ENOBUFS;
2390
+
return nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
2391
+
-ENOBUFS;
2391
2392
} else {
2392
-
err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
2393
+
return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
2393
2394
}
2395
+
}
2396
+
2397
+
int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
2398
+
{
2399
+
struct tcp_sock *tp = tcp_sk(sk);
2400
+
int err = __tcp_retransmit_skb(sk, skb);
2394
2401
2395
2402
if (err == 0) {
2396
2403
/* Update global TCP statistics. */