diff options
| author | Paolo Abeni <[email protected]> | 2020-11-18 23:05:34 +0100 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2020-11-19 21:54:24 -0800 |
| commit | b680a214ec281dbd44b5ebbf3f126a57f1ecf0f7 (patch) | |
| tree | 8bbd114bccb17adb18a9fc0e08beb29af36c7827 | |
| parent | ac75b09624ed679e239b75081923a6d33ae35876 (diff) | |
mptcp: update rtx timeout only if required.
We must start the retransmission timer only there are
pending data in the rtx queue.
Otherwise we can hit a WARN_ON in mptcp_reset_timer(),
as syzbot demonstrated.
Reported-and-tested-by: [email protected]
Fixes: d9ca1de8c0cd ("mptcp: move page frag allocation in mptcp_sendmsg()")
Signed-off-by: Paolo Abeni <[email protected]>
Reviewed-by: Mat Martineau <[email protected]>
Reported-by: Naresh Kamboju <[email protected]>
Tested-by: Naresh Kamboju <[email protected]>
Link: https://lore.kernel.org/r/1a72039f112cae048c44d398ffa14e0a1432db3d.1605737083.git.pabeni@redhat.com
Signed-off-by: Jakub Kicinski <[email protected]>
| -rw-r--r-- | net/mptcp/protocol.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 8df013daea88..aeda4357de9a 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1261,11 +1261,12 @@ static void mptcp_push_pending(struct sock *sk, unsigned int flags) mptcp_push_release(sk, ssk, &info); out: - /* start the timer, if it's not pending */ - if (!mptcp_timer_pending(sk)) - mptcp_reset_timer(sk); - if (copied) + if (copied) { + /* start the timer, if it's not pending */ + if (!mptcp_timer_pending(sk)) + mptcp_reset_timer(sk); __mptcp_check_send_data_fin(sk); + } } static int mptcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) |