From 6e42141009ff18297fe19d19296738b742f861db Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ilpo=20J=E4rvinen?= Date: Mon, 19 Nov 2007 23:24:09 -0800 Subject: [TCP] MTUprobe: fix potential sk_send_head corruption MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the abstraction functions got added, conversion here was made incorrectly. As a result, the skb may end up pointing to skb which got included to the probe skb and then was freed. For it to trigger, however, skb_transmit must fail sending as well. Signed-off-by: Ilpo Järvinen Signed-off-by: David S. Miller --- include/net/tcp.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'include') diff --git a/include/net/tcp.h b/include/net/tcp.h index d695cea7730d..cb5b033e0e59 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1288,6 +1288,9 @@ static inline void tcp_insert_write_queue_before(struct sk_buff *new, struct sock *sk) { __skb_insert(new, skb->prev, skb, &sk->sk_write_queue); + + if (sk->sk_send_head == skb) + sk->sk_send_head = new; } static inline void tcp_unlink_write_queue(struct sk_buff *skb, struct sock *sk) -- cgit v1.2.2