| Message ID | 1a72039f112cae048c44d398ffa14e0a1432db3d.1605737083.git.pabeni@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] mptcp: update rtx timeout only if required. | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net-next |
| netdev/subject_prefix | success | Link |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 6 this patch: 6 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 16 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 6 this patch: 6 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
On Wed, 18 Nov 2020, Paolo Abeni wrote: > We must start the retransmission timer only there are > pending data in the rtx queue. > Otherwise we can hit a WARN_ON in mptcp_reset_timer(), > as syzbot demonstrated. > > Reported-and-tested-by: syzbot+42aa53dafb66a07e5a24@syzkaller.appspotmail.com > Fixes: d9ca1de8c0cd ("mptcp: move page frag allocation in mptcp_sendmsg()") > Signed-off-by: Paolo Abeni <pabeni@redhat.com> > --- > net/mptcp/protocol.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com> -- Mat Martineau Intel
On Thu, 19 Nov 2020 at 06:13, Mat Martineau <mathew.j.martineau@linux.intel.com> wrote: > > > On Wed, 18 Nov 2020, Paolo Abeni wrote: > > > We must start the retransmission timer only there are > > pending data in the rtx queue. > > Otherwise we can hit a WARN_ON in mptcp_reset_timer(), > > as syzbot demonstrated. > > > > Reported-and-tested-by: syzbot+42aa53dafb66a07e5a24@syzkaller.appspotmail.com > > Fixes: d9ca1de8c0cd ("mptcp: move page frag allocation in mptcp_sendmsg()") > > Signed-off-by: Paolo Abeni <pabeni@redhat.com> > > --- > > net/mptcp/protocol.c | 9 +++++---- > > 1 file changed, 5 insertions(+), 4 deletions(-) > > > > Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com> Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org> Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org> The reported kernel warning was fixed after applying this fix on top of Linux next tag 20201119. - Naresh
On Thu, 19 Nov 2020 19:49:16 +0530 Naresh Kamboju wrote: > > > We must start the retransmission timer only there are > > > pending data in the rtx queue. > > > Otherwise we can hit a WARN_ON in mptcp_reset_timer(), > > > as syzbot demonstrated. > > > > > > Reported-and-tested-by: syzbot+42aa53dafb66a07e5a24@syzkaller.appspotmail.com > > > Fixes: d9ca1de8c0cd ("mptcp: move page frag allocation in mptcp_sendmsg()") > > > Signed-off-by: Paolo Abeni <pabeni@redhat.com> > > > > Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com> > > Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org> > Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org> Applied, thanks!
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 8df013daea88..aeda4357de9a 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1261,11 +1261,12 @@ static void mptcp_push_pending(struct sock *sk, unsigned int flags) mptcp_push_release(sk, ssk, &info); out: - /* start the timer, if it's not pending */ - if (!mptcp_timer_pending(sk)) - mptcp_reset_timer(sk); - if (copied) + if (copied) { + /* start the timer, if it's not pending */ + if (!mptcp_timer_pending(sk)) + mptcp_reset_timer(sk); __mptcp_check_send_data_fin(sk); + } } static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
We must start the retransmission timer only there are pending data in the rtx queue. Otherwise we can hit a WARN_ON in mptcp_reset_timer(), as syzbot demonstrated. Reported-and-tested-by: syzbot+42aa53dafb66a07e5a24@syzkaller.appspotmail.com Fixes: d9ca1de8c0cd ("mptcp: move page frag allocation in mptcp_sendmsg()") Signed-off-by: Paolo Abeni <pabeni@redhat.com> --- net/mptcp/protocol.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)