From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from youngberry.canonical.com ([91.189.89.112]:39280 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751037AbbEARNF (ORCPT ); Fri, 1 May 2015 13:13:05 -0400 Message-ID: <1430500380.25872.22.camel@fourier> Subject: Re: [PATCH stable 3.10-3.16] tcp: Fix crash in TCP Fast Open From: Kamal Mostafa To: Ben Hutchings Cc: stable , netdev , Eric Dumazet , 782515@bugs.debian.org Date: Fri, 01 May 2015 10:13:00 -0700 In-Reply-To: <1429120832.3211.91.camel@decadent.org.uk> References: <1429120832.3211.91.camel@decadent.org.uk> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: On Wed, 2015-04-15 at 19:00 +0100, Ben Hutchings wrote: > Commit 355a901e6cf1 ("tcp: make connect() mem charging friendly") > changed tcp_send_syn_data() to perform an open-coded copy of the 'syn' > skb rather than using skb_copy_expand(). > > The open-coded copy does not cover the skb_shared_info::gso_segs > field, so in the new skb it is left set to 0. When this commit was > backported into stable branches between 3.10.y and 3.16.7-ckty > inclusive, it triggered the BUG() in tcp_transmit_skb(). > > Since Linux 3.18 the GSO segment count is kept in the > tcp_skb_cb::tcp_gso_segs field and tcp_send_syn_data() does copy the > tcp_skb_cb structure to the new skb, so mainline and newer stable > branches are not affected. > > Set skb_shared_info::gso_segs to the correct value of 1. > > Signed-off-by: Ben Hutchings Queued for 3.13-stable. Thanks very much, Ben! -Kamal > --- > net/ipv4/tcp_output.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c > index d5457e4..1ea0a07 100644 > --- a/net/ipv4/tcp_output.c > +++ b/net/ipv4/tcp_output.c > @@ -2992,6 +2992,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) > goto fallback; > syn_data->ip_summed = CHECKSUM_PARTIAL; > memcpy(syn_data->cb, syn->cb, sizeof(syn->cb)); > + skb_shinfo(syn_data)->gso_segs = 1; > if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space), > fo->data->msg_iov, 0, space))) { > kfree_skb(syn_data); >