aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv4
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2016-09-14 01:55:05 -0400
committerDavid S. Miller <davem@davemloft.net>2016-09-16 04:09:49 -0400
commit76f0dcbb5ae1a7c3dbeec13dd98233b8e6b0b32a (patch)
tree56d2b7281a53ccd8ca6b863f3d16c03f967be8df /net/ipv4
parentbf0a6dae9d2741a9827774cdcfd5fca436bedd23 (diff)
tcp: fix a stale ooo_last_skb after a replace
When skb replaces another one in ooo queue, I forgot to also update tp->ooo_last_skb as well, if the replaced skb was the last one in the queue. To fix this, we simply can re-use the code that runs after an insertion, trying to merge skbs at the right of current skb. This not only fixes the bug, but also remove all small skbs that might be a subset of the new one. Example: We receive segments 2001:3001, 4001:5001 Then we receive 2001:8001 : We should replace 2001:3001 with the big skb, but also remove 4001:50001 from the queue to save space. packetdrill test demonstrating the bug 0.000 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1) = 0 +0 < S 0:0(0) win 32792 <mss 1000,sackOK,nop,nop,nop,wscale 7> +0 > S. 0:0(0) ack 1 <mss 1460,nop,nop,sackOK,nop,wscale 7> +0.100 < . 1:1(0) ack 1 win 1024 +0 accept(3, ..., ...) = 4 +0.01 < . 1001:2001(1000) ack 1 win 1024 +0 > . 1:1(0) ack 1 <nop,nop, sack 1001:2001> +0.01 < . 1001:3001(2000) ack 1 win 1024 +0 > . 1:1(0) ack 1 <nop,nop, sack 1001:2001 1001:3001> Fixes: 9f5afeae5152 ("tcp: use an RB tree for ooo receive queue") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Yuchung Cheng <ycheng@google.com> Cc: Yaogong Wang <wygivan@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4')
-rw-r--r--net/ipv4/tcp_input.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 70b892db9901..dad3e7eeed94 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4502,7 +4502,7 @@ coalesce_done:
4502 NET_INC_STATS(sock_net(sk), 4502 NET_INC_STATS(sock_net(sk),
4503 LINUX_MIB_TCPOFOMERGE); 4503 LINUX_MIB_TCPOFOMERGE);
4504 __kfree_skb(skb1); 4504 __kfree_skb(skb1);
4505 goto add_sack; 4505 goto merge_right;
4506 } 4506 }
4507 } else if (tcp_try_coalesce(sk, skb1, skb, &fragstolen)) { 4507 } else if (tcp_try_coalesce(sk, skb1, skb, &fragstolen)) {
4508 goto coalesce_done; 4508 goto coalesce_done;
@@ -4514,6 +4514,7 @@ insert:
4514 rb_link_node(&skb->rbnode, parent, p); 4514 rb_link_node(&skb->rbnode, parent, p);
4515 rb_insert_color(&skb->rbnode, &tp->out_of_order_queue); 4515 rb_insert_color(&skb->rbnode, &tp->out_of_order_queue);
4516 4516
4517merge_right:
4517 /* Remove other segments covered by skb. */ 4518 /* Remove other segments covered by skb. */
4518 while ((q = rb_next(&skb->rbnode)) != NULL) { 4519 while ((q = rb_next(&skb->rbnode)) != NULL) {
4519 skb1 = rb_entry(q, struct sk_buff, rbnode); 4520 skb1 = rb_entry(q, struct sk_buff, rbnode);