From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.4 01/34] tcp: fix overflow in __tcp_retransmit_skb()
Date: Sun, 13 Nov 2016 12:24:33 +0100 [thread overview]
Message-ID: <20161113112400.076055382@linuxfoundation.org> (raw)
In-Reply-To: <20161113112400.008903838@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit ffb4d6c8508657824bcef68a36b2a0f9d8c09d10 ]
If a TCP socket gets a large write queue, an overflow can happen
in a test in __tcp_retransmit_skb() preventing all retransmits.
The flow then stalls and resets after timeouts.
Tested:
sysctl -w net.core.wmem_max=1000000000
netperf -H dest -- -s 1000000000
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_output.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2569,7 +2569,8 @@ int __tcp_retransmit_skb(struct sock *sk
* copying overhead: fragmentation, tunneling, mangling etc.
*/
if (atomic_read(&sk->sk_wmem_alloc) >
- min(sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), sk->sk_sndbuf))
+ min_t(u32, sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2),
+ sk->sk_sndbuf))
return -EAGAIN;
if (skb_still_in_host_queue(sk, skb))
next prev parent reply other threads:[~2016-11-13 11:24 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161113112504epcas1p23b8af4aabfbd40c07be5d48fcfd80e44@epcas1p2.samsung.com>
2016-11-13 11:24 ` [PATCH 4.4 00/34] 4.4.32-stable review Greg Kroah-Hartman
2016-11-13 11:24 ` Greg Kroah-Hartman [this message]
2016-11-13 11:24 ` [PATCH 4.4 02/34] net: avoid sk_forward_alloc overflows Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 03/34] tcp: fix wrong checksum calculation on MTU probing Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 04/34] tcp: fix a compile error in DBGUNDO() Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 05/34] ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 06/34] ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 07/34] tg3: Avoid NULL pointer dereference in tg3_io_error_detected() Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 09/34] net: pktgen: fix pkt_size Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 10/34] net/sched: act_vlan: Push skb->data to mac_header prior calling skb_vlan_*() functions Greg Kroah-Hartman
2016-11-14 7:07 ` Shmulik Ladkani
2016-11-13 11:24 ` [PATCH 4.4 11/34] net: Add netdev all_adj_list refcnt propagation to fix panic Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 12/34] packet: call fanout_release, while UNREGISTERING a netdev Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 13/34] netlink: do not enter direct reclaim from netlink_dump() Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 14/34] ipv6: tcp: restore IP6CB for pktoptions skbs Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 15/34] ip6_tunnel: fix ip6_tnl_lookup Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 16/34] ipv6: correctly add local routes when lo goes up Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 17/34] net: pktgen: remove rcu locking in pktgen_change_name() Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 18/34] bridge: multicast: restore perm router ports on multicast enable Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 19/34] rtnetlink: Add rtnexthop offload flag to compare mask Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 21/34] ipv4: disable BH in set_ping_group_range() Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 22/34] ipv4: use the right lock for ping_group_range Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 23/34] net: sctp, forbid negative length Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 24/34] udp: fix IP_CHECKSUM handling Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 25/34] net sched filters: fix notification of filter delete with proper handle Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 26/34] sctp: validate chunk len before actually using it Greg Kroah-Hartman
2016-11-13 11:24 ` [PATCH 4.4 27/34] packet: on direct_xmit, limit tso and csum to supported devices Greg Kroah-Hartman
2016-11-13 11:25 ` [PATCH 4.4 32/34] drm/amdgpu: fix DP mode validation Greg Kroah-Hartman
2016-11-13 11:25 ` [PATCH 4.4 34/34] drm/radeon: " Greg Kroah-Hartman
2016-11-13 20:41 ` [PATCH 4.4 00/34] 4.4.32-stable review Guenter Roeck
[not found] ` <5828d40c.212dc20a.9adc7.8f2f@mx.google.com>
2016-11-14 7:53 ` Greg Kroah-Hartman
2016-11-14 16:47 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161113112400.076055382@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).