Skip to content

Commit

Permalink
tcp: fix crash in tcp_xmit_retransmit_queue
Browse files Browse the repository at this point in the history
It can happen that there are no packets in queue while calling
tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns
NULL and that gets deref'ed to get sacked into a local var.

There is no work to do if no packets are outstanding so we just
exit early.

This oops was introduced by 08ebd17 (tcp: remove tp->lost_out
guard to make joining diff nicer).

Signed-off-by: Ilpo Järvinen <[email protected]>
Reported-by: Lennart Schulte <[email protected]>
Tested-by: Lennart Schulte <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
  • Loading branch information
ij1 authored and davem330 committed Jul 19, 2010
1 parent b508998 commit 45e77d3
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions net/ipv4/tcp_output.c
Original file line number Diff line number Diff line change
Expand Up @@ -2208,6 +2208,9 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
int mib_idx;
int fwd_rexmitting = 0;

if (!tp->packets_out)
return;

if (!tp->lost_out)
tp->retransmit_high = tp->snd_una;

Expand Down

0 comments on commit 45e77d3

Please sign in to comment.