From patchwork Thu Jan 2 22:08:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 234704 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B5DBC3276C for ; Thu, 2 Jan 2020 22:33:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0DBF120863 for ; Thu, 2 Jan 2020 22:33:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578004416; bh=QIJEMpMgif8cr5BfWx9VYHU4uTMqaApzdAMh4JrEtMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=sxm5eOfCNAr9S6Yc5G3usEMiNoFJn1pFmC+bcvVEyBSyUTRpU/cO4wcEakGPG1hLR WETW2c6+ZaC2oyDWK3fHuCp577xr0gUzxaITmZBBghxaGwbiyUJmgcEmywiN12/mlM q6+xzNxuf3KZSFWgWUuRu7NXLz+aoV6wnTa49ZOM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728853AbgABWdf (ORCPT ); Thu, 2 Jan 2020 17:33:35 -0500 Received: from mail.kernel.org ([198.145.29.99]:41162 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728842AbgABWde (ORCPT ); Thu, 2 Jan 2020 17:33:34 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B365B22314; Thu, 2 Jan 2020 22:33:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1578004414; bh=QIJEMpMgif8cr5BfWx9VYHU4uTMqaApzdAMh4JrEtMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T61sSChOdO/K5McHr/fc3D6qFJmT4d5+DGuH37z5asq6BOyGFtgfjYBitF4Q/IrzV 33IjkyZKClY1URq5hEmDig+odrbIsuIlVzH/6rq3ej3MtBbJHs1QIEWcccxT5sh9hw zh2ayZSWXuamabYK5X/zbo7XIdUnyyZsS+uII6Xc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Christoph Paasch , Neal Cardwell , Jason Baron , Soheil Hassas Yeganeh , Jakub Kicinski Subject: [PATCH 4.9 169/171] tcp: do not send empty skb from tcp_write_xmit() Date: Thu, 2 Jan 2020 23:08:20 +0100 Message-Id: <20200102220610.081992094@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20200102220546.960200039@linuxfoundation.org> References: <20200102220546.960200039@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet [ Upstream commit 1f85e6267caca44b30c54711652b0726fadbb131 ] Backport of commit fdfc5c8594c2 ("tcp: remove empty skb from write queue in error cases") in linux-4.14 stable triggered various bugs. One of them has been fixed in commit ba2ddb43f270 ("tcp: Don't dequeue SYN/FIN-segments from write-queue"), but we still have crashes in some occasions. Root-cause is that when tcp_sendmsg() has allocated a fresh skb and could not append a fragment before being blocked in sk_stream_wait_memory(), tcp_write_xmit() might be called and decide to send this fresh and empty skb. Sending an empty packet is not only silly, it might have caused many issues we had in the past with tp->packets_out being out of sync. Fixes: c65f7f00c587 ("[TCP]: Simplify SKB data portion allocation with NETIF_F_SG.") Signed-off-by: Eric Dumazet Cc: Christoph Paasch Acked-by: Neal Cardwell Cc: Jason Baron Acked-by: Soheil Hassas Yeganeh Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/ipv4/tcp_output.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2233,6 +2233,14 @@ static bool tcp_write_xmit(struct sock * if (tcp_small_queue_check(sk, skb, 0)) break; + /* Argh, we hit an empty skb(), presumably a thread + * is sleeping in sendmsg()/sk_stream_wait_memory(). + * We do not want to send a pure-ack packet and have + * a strange looking rtx queue with empty packet(s). + */ + if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) + break; + if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp))) break;