Re: [PATCHv2] tcp: fix crash in tcp_xmit_retransmit_queue

Eric Dumazet
2010-07-19T17:39:15Z

Le lundi 19 juillet 2010 à 20:25 +0300, Ilpo Järvinen a écrit :

> This difference is well thought and intentional, I didn't use different
> one by accident. We want to make sure we won't use NULL from
> tcp_write_queue_head() while the pre 08ebd1721ab8fd3 kernels was
> interested mainly whether the first loop should run or not (and of course
> ends up avoid the null deref too but it's more optimization like
> thing in there, ie., if there's no lost packets no work to-do). The deref
> could have been fixed by moving TCP_SKB_CB(skb)->sacked a bit later but
> that would again make us depend on the side-effect of the send_head check
> (in the case of packets_out being zero and wq empty) which is something I
> don't like too much.
>

Thanks Ilpo.

Do you know in what exact circumstance the bug triggers ?

It's hard to believe thousand of machines on the Internet never hit
it :(

Maybe another problem in congestion control ?