4.4-stable patches

added patches:
	tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch

diff --git a/queue-4.4/mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch b/queue-4.4/mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch
index 3cdd4041b2ea501eba9e614bab45862b3de6e197..40cef7314937cca98d71bc830721f1ba87dc0777 100644 (file)
--- a/queue-4.4/mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch
+++ b/queue-4.4/mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch
@@ -23,15 +23,14 @@ Cc: stable@vger.kernel.org # v4.4+
 Link: https://lore.kernel.org/r/20191206114326.15856-1-faiz_abbas@ti.com
 Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
- drivers/mmc/host/sdhci.c | 2 +-
+ drivers/mmc/host/sdhci.c |    2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index 62d37d2ac557..2bae0214528b 100644
 --- a/drivers/mmc/host/sdhci.c
 +++ b/drivers/mmc/host/sdhci.c
-@@ -2033,7 +2033,7 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
+@@ -2033,7 +2033,7 @@ static int sdhci_execute_tuning(struct m
                spin_lock_irqsave(&host->lock, flags);
  
                if (!host->tuning_done) {
@@ -40,6 +39,3 @@ index 62d37d2ac557..2bae0214528b 100644
                                "Buffer Read Ready interrupt during tuning "
                                "procedure, falling back to fixed sampling "
                                "clock\n");
--- 
-2.20.1
-

diff --git a/queue-4.4/series b/queue-4.4/series
index 0856399eede8ae9a58e6fe659ab4f721640b3017..ce4a82cbeb02a6da984cadd102874860a19ad888 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -134,3 +134,4 @@ netfilter-bridge-make-sure-to-pull-arp-header-in-br_nf_forward_arp.patch
 net-icmp-fix-data-race-in-cmp_global_allow.patch
 hrtimer-annotate-lockless-access-to-timer-state.patch
 mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch
+tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch

diff --git a/queue-4.4/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch b/queue-4.4/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch
new file mode 100644 (file)
index 0000000..b150243
--- /dev/null
+++ b/queue-4.4/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch
@@ -0,0 +1,53 @@
+From foo@baz Thu 02 Jan 2020 12:25:40 PM CET
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 12 Dec 2019 12:55:29 -0800
+Subject: tcp: do not send empty skb from tcp_write_xmit()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 1f85e6267caca44b30c54711652b0726fadbb131 ]
+
+Backport of commit fdfc5c8594c2 ("tcp: remove empty skb from
+write queue in error cases") in linux-4.14 stable triggered
+various bugs. One of them has been fixed in commit ba2ddb43f270
+("tcp: Don't dequeue SYN/FIN-segments from write-queue"), but
+we still have crashes in some occasions.
+
+Root-cause is that when tcp_sendmsg() has allocated a fresh
+skb and could not append a fragment before being blocked
+in sk_stream_wait_memory(), tcp_write_xmit() might be called
+and decide to send this fresh and empty skb.
+
+Sending an empty packet is not only silly, it might have caused
+many issues we had in the past with tp->packets_out being
+out of sync.
+
+Fixes: c65f7f00c587 ("[TCP]: Simplify SKB data portion allocation with NETIF_F_SG.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Christoph Paasch <cpaasch@apple.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Cc: Jason Baron <jbaron@akamai.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp_output.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2148,6 +2148,14 @@ static bool tcp_write_xmit(struct sock *
+                               break;
+               }
+ 
++              /* Argh, we hit an empty skb(), presumably a thread
++               * is sleeping in sendmsg()/sk_stream_wait_memory().
++               * We do not want to send a pure-ack packet and have
++               * a strange looking rtx queue with empty packet(s).
++               */
++              if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq)
++                      break;
++
+               if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
+                       break;
+