android_kernel_xiaomi_sm8350/net
Herbert Xu 35d59efd10 [TCP]: Fix bug #5070: kernel BUG at net/ipv4/tcp_output.c:864
1) We send out a normal sized packet with TSO on to start off.
2) ICMP is received indicating a smaller MTU.
3) We send the current sk_send_head which needs to be fragmented
since it was created before the ICMP event.  The first fragment
is then sent out.

At this point the remaining fragment is allocated by tcp_fragment.
However, its size is padded to fit the L1 cache-line size therefore
creating tail-room up to 124 bytes long.

This fragment will also be sitting at sk_send_head.

4) tcp_sendmsg is called again and it stores data in the tail-room of
of the fragment.
5) tcp_push_one is called by tcp_sendmsg which then calls tso_fragment
since the packet as a whole exceeds the MTU.

At this point we have a packet that has data in the head area being
fed to tso_fragment which bombs out.

My take on this is that we shouldn't ever call tcp_fragment on a TSO
socket for a packet that is yet to be transmitted since this creates
a packet on sk_send_head that cannot be extended.

So here is a patch to change it so that tso_fragment is always used
in this case.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-08-17 12:03:59 -07:00
..
802 [NET]: __be'ify *_type_trans() 2005-07-12 12:08:43 -07:00
8021q [VLAN]: Fix early vlan adding leads to not functional device 2005-07-12 12:13:49 -07:00
appletalk [ATALK] aarp: replace schedule_timeout() with msleep() 2005-06-22 22:11:44 -07:00
atm [ATM]: Trivial spelling fix patch for net/Kconfig 2005-07-19 13:56:53 -07:00
ax25 [AX25] Introduce ax25_type_trans 2005-04-24 18:53:06 -07:00
bluetooth [Bluetooth] Add direction and timestamp to stack internal events 2005-08-06 12:36:54 +02:00
bridge [NET]: BRIDGE_EBT_ARPREPLY must depend on INET 2005-07-19 14:00:13 -07:00
core [NETPOLL]: remove unused variable 2005-08-11 19:28:05 -07:00
decnet [DECNET]: Use sk_stream_error function rather than DECnet's own 2005-08-10 11:32:57 -07:00
econet [NET]: move config options out to individual protocols 2005-07-11 21:13:56 -07:00
ethernet [NET]: __be'ify *_type_trans() 2005-07-12 12:08:43 -07:00
ipv4 [TCP]: Fix bug #5070: kernel BUG at net/ipv4/tcp_output.c:864 2005-08-17 12:03:59 -07:00
ipv6 [IPV6]: Fix raw socket hardware checksum failures 2005-08-17 12:03:32 -07:00
ipx [NET]: move config options out to individual protocols 2005-07-11 21:13:56 -07:00
irda [NET]: Transform skb_queue_len() binary tests into skb_queue_empty() 2005-07-08 14:57:23 -07:00
key [IPSEC]: Add XFRM_STATE_NOPMTUDISC flag 2005-06-20 13:21:43 -07:00
lapb [NET]: move config options out to individual protocols 2005-07-11 21:13:56 -07:00
llc [NET]: Transform skb_queue_len() binary tests into skb_queue_empty() 2005-07-08 14:57:23 -07:00
netlink [NETLINK]: Fix "nocast type" warnings 2005-07-18 13:35:43 -07:00
netrom Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
packet [NETFILTER]: Revert nf_reset change 2005-07-12 11:57:52 -07:00
rose Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
rxrpc [PATCH] Cleanup patch for process freezing 2005-06-25 17:10:13 -07:00
sched [EMATCH]: Remove feature ifdefs in meta ematch. 2005-07-24 19:44:23 -07:00
sctp [SCTP]: Fix potential null pointer dereference while handling an icmp error 2005-07-18 13:44:10 -07:00
sunrpc [PATCH] NFS: Ensure ACL xdr code doesn't overflow. 2005-08-16 08:52:11 -07:00
unix [NET]: move config options out to individual protocols 2005-07-11 21:13:56 -07:00
wanrouter [NET]: __be'ify *_type_trans() 2005-07-12 12:08:43 -07:00
x25 [NET]: move config options out to individual protocols 2005-07-11 21:13:56 -07:00
xfrm [XFRM]: Fix possible overflow of sock->sk_policy 2005-07-26 15:43:17 -07:00
compat.c [NET]: Fix memory leak in sys_{send,recv}msg() w/compat 2005-08-09 15:29:19 -07:00
Kconfig [NET]: Kconfig: NETCONSOLE and NETPOLL together 2005-07-18 13:45:12 -07:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
nonet.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
socket.c [NET]: dont use strlen() but the result from a prior sprintf() 2005-06-22 14:32:51 -07:00
sysctl_net.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
TUNABLE Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00