4.19-stable patches

added patches:
	tcp-exit-if-nothing-to-retransmit-on-rto-timeout.patch

diff --git a/queue-4.19/series b/queue-4.19/series
index be0138560e3eddb7692f9fc069d5a44f71dc50d7..831bcefac60a14289395fa6fe815a45228c1ee00 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -301,3 +301,4 @@ mtd-rawnand-atmel-fix-possible-object-reference-leak.patch
 mtd-spi-nor-cast-to-u64-to-avoid-uint-overflows.patch
 drm-atmel-hlcdc-revert-shift-by-8.patch
 mailbox-stm32_ipcc-add-spinlock-to-fix-channels-concurrent-access.patch
+tcp-exit-if-nothing-to-retransmit-on-rto-timeout.patch

diff --git a/queue-4.19/tcp-exit-if-nothing-to-retransmit-on-rto-timeout.patch b/queue-4.19/tcp-exit-if-nothing-to-retransmit-on-rto-timeout.patch
new file mode 100644 (file)
index 0000000..60cf732
--- /dev/null
+++ b/queue-4.19/tcp-exit-if-nothing-to-retransmit-on-rto-timeout.patch
@@ -0,0 +1,40 @@
+From 88f8598d0a302a08380eadefd09b9f5cb1c4c428 Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng@google.com>
+Date: Wed, 16 Jan 2019 15:05:28 -0800
+Subject: tcp: exit if nothing to retransmit on RTO timeout
+
+From: Yuchung Cheng <ycheng@google.com>
+
+commit 88f8598d0a302a08380eadefd09b9f5cb1c4c428 upstream.
+
+Previously TCP only warns if its RTO timer fires and the
+retransmission queue is empty, but it'll cause null pointer
+reference later on. It's better to avoid such catastrophic failure
+and simply exit with a warning.
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Neal Cardwell <ncardwell@google.com>
+Reviewed-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/tcp_timer.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -443,10 +443,8 @@ void tcp_retransmit_timer(struct sock *s
+                */
+               return;
+       }
+-      if (!tp->packets_out)
+-              goto out;
+-
+-      WARN_ON(tcp_rtx_queue_empty(sk));
++      if (!tp->packets_out || WARN_ON_ONCE(tcp_rtx_queue_empty(sk)))
++              return;
+ 
+       tp->tlp_high_seq = 0;
+