Commit bd3fa7e1 authored by Yuchung Cheng's avatar Yuchung Cheng Committed by Greg Kroah-Hartman

tcp: fix NULL ref in tail loss probe

[ Upstream commit b2b7af861122a0c0f6260155c29a1b2e594cd5b5 ]

TCP loss probe timer may fire when the retranmission queue is empty but
has a non-zero tp->packets_out counter. tcp_send_loss_probe will call
tcp_rearm_rto which triggers NULL pointer reference by fetching the
retranmission queue head in its sub-routines.

Add a more detailed warning to help catch the root cause of the inflight
accounting inconsistency.
Reported-by: default avatarRafael Tinoco <>
Signed-off-by: default avatarYuchung Cheng <>
Signed-off-by: default avatarEric Dumazet <>
Signed-off-by: default avatarNeal Cardwell <>
Signed-off-by: default avatarDavid S. Miller <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent fe25279d
......@@ -2346,14 +2346,18 @@ void tcp_send_loss_probe(struct sock *sk)
skb = tcp_write_queue_tail(sk);
if (unlikely(!skb)) {
"invalid inflight: %u state %u cwnd %u mss %d\n",
tp->packets_out, sk->sk_state, tp->snd_cwnd, mss);
inet_csk(sk)->icsk_pending = 0;
/* At most one outstanding TLP retransmission. */
if (tp->tlp_high_seq)
goto rearm_timer;
/* Retransmit last segment. */
if (WARN_ON(!skb))
goto rearm_timer;
if (skb_still_in_host_queue(sk, skb))
goto rearm_timer;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment