From: Greg Kroah-Hartman Date: Thu, 2 Jan 2020 11:29:58 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.208~11 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b01f4cba27f5398ef52ca86cf9395001280a3469;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch --- diff --git a/queue-4.4/mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch b/queue-4.4/mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch index 3cdd4041b2e..40cef731493 100644 --- a/queue-4.4/mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch +++ b/queue-4.4/mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch @@ -23,15 +23,14 @@ Cc: stable@vger.kernel.org # v4.4+ Link: https://lore.kernel.org/r/20191206114326.15856-1-faiz_abbas@ti.com Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman --- - drivers/mmc/host/sdhci.c | 2 +- + drivers/mmc/host/sdhci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 62d37d2ac557..2bae0214528b 100644 --- a/drivers/mmc/host/sdhci.c +++ b/drivers/mmc/host/sdhci.c -@@ -2033,7 +2033,7 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode) +@@ -2033,7 +2033,7 @@ static int sdhci_execute_tuning(struct m spin_lock_irqsave(&host->lock, flags); if (!host->tuning_done) { @@ -40,6 +39,3 @@ index 62d37d2ac557..2bae0214528b 100644 "Buffer Read Ready interrupt during tuning " "procedure, falling back to fixed sampling " "clock\n"); --- -2.20.1 - diff --git a/queue-4.4/series b/queue-4.4/series index 0856399eede..ce4a82cbeb0 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -134,3 +134,4 @@ netfilter-bridge-make-sure-to-pull-arp-header-in-br_nf_forward_arp.patch net-icmp-fix-data-race-in-cmp_global_allow.patch hrtimer-annotate-lockless-access-to-timer-state.patch mmc-sdhci-update-the-tuning-failed-messages-to-pr_de.patch +tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch diff --git a/queue-4.4/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch b/queue-4.4/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch new file mode 100644 index 00000000000..b150243d4d5 --- /dev/null +++ b/queue-4.4/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch @@ -0,0 +1,53 @@ +From foo@baz Thu 02 Jan 2020 12:25:40 PM CET +From: Eric Dumazet +Date: Thu, 12 Dec 2019 12:55:29 -0800 +Subject: tcp: do not send empty skb from tcp_write_xmit() + +From: Eric Dumazet + +[ Upstream commit 1f85e6267caca44b30c54711652b0726fadbb131 ] + +Backport of commit fdfc5c8594c2 ("tcp: remove empty skb from +write queue in error cases") in linux-4.14 stable triggered +various bugs. One of them has been fixed in commit ba2ddb43f270 +("tcp: Don't dequeue SYN/FIN-segments from write-queue"), but +we still have crashes in some occasions. + +Root-cause is that when tcp_sendmsg() has allocated a fresh +skb and could not append a fragment before being blocked +in sk_stream_wait_memory(), tcp_write_xmit() might be called +and decide to send this fresh and empty skb. + +Sending an empty packet is not only silly, it might have caused +many issues we had in the past with tp->packets_out being +out of sync. + +Fixes: c65f7f00c587 ("[TCP]: Simplify SKB data portion allocation with NETIF_F_SG.") +Signed-off-by: Eric Dumazet +Cc: Christoph Paasch +Acked-by: Neal Cardwell +Cc: Jason Baron +Acked-by: Soheil Hassas Yeganeh +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_output.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2148,6 +2148,14 @@ static bool tcp_write_xmit(struct sock * + break; + } + ++ /* Argh, we hit an empty skb(), presumably a thread ++ * is sleeping in sendmsg()/sk_stream_wait_memory(). ++ * We do not want to send a pure-ack packet and have ++ * a strange looking rtx queue with empty packet(s). ++ */ ++ if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) ++ break; ++ + if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp))) + break; +