From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kamal Mostafa Subject: Re: [PATCH stable 3.10-3.16] tcp: Fix crash in TCP Fast Open Date: Fri, 01 May 2015 10:13:00 -0700 Message-ID: <1430500380.25872.22.camel@fourier> References: <1429120832.3211.91.camel@decadent.org.uk> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Cc: stable , netdev , Eric Dumazet , 782515@bugs.debian.org To: Ben Hutchings Return-path: In-Reply-To: <1429120832.3211.91.camel@decadent.org.uk> Sender: stable-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Wed, 2015-04-15 at 19:00 +0100, Ben Hutchings wrote: > Commit 355a901e6cf1 ("tcp: make connect() mem charging friendly") > changed tcp_send_syn_data() to perform an open-coded copy of the 'syn' > skb rather than using skb_copy_expand(). > > The open-coded copy does not cover the skb_shared_info::gso_segs > field, so in the new skb it is left set to 0. When this commit was > backported into stable branches between 3.10.y and 3.16.7-ckty > inclusive, it triggered the BUG() in tcp_transmit_skb(). > > Since Linux 3.18 the GSO segment count is kept in the > tcp_skb_cb::tcp_gso_segs field and tcp_send_syn_data() does copy the > tcp_skb_cb structure to the new skb, so mainline and newer stable > branches are not affected. > > Set skb_shared_info::gso_segs to the correct value of 1. > > Signed-off-by: Ben Hutchings Queued for 3.13-stable. Thanks very much, Ben! -Kamal > --- > net/ipv4/tcp_output.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c > index d5457e4..1ea0a07 100644 > --- a/net/ipv4/tcp_output.c > +++ b/net/ipv4/tcp_output.c > @@ -2992,6 +2992,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) > goto fallback; > syn_data->ip_summed = CHECKSUM_PARTIAL; > memcpy(syn_data->cb, syn->cb, sizeof(syn->cb)); > + skb_shinfo(syn_data)->gso_segs = 1; > if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space), > fo->data->msg_iov, 0, space))) { > kfree_skb(syn_data); >