Messages in this thread Patch in this message | | | Subject | Re: [PATCH] tcp: Avoid infinite loop on recvmsg bug | From | Eric Dumazet <> | Date | Wed, 07 Nov 2012 15:42:34 -0800 |
| |
On Wed, 2012-11-07 at 15:33 -0800, Eric Dumazet wrote:
> So you probably are fighting a bug we already fixed in upstream kernel. > > (commit c8628155ece363 "tcp: reduce out_of_order memory use" did not > played well with cloned skbs.) > > This issue was already discussed on netdev in the past.
If you use a 3.4 kernel, you want the following patch.
(I guess you could reproduce the crash easily running a tcpdump in //)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 257b617..9f8f68c 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -4496,7 +4496,9 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) * to avoid future tcp_collapse_ofo_queue(), * probably the most expensive function in tcp stack. */ - if (skb->len <= skb_tailroom(skb1) && !tcp_hdr(skb)->fin) { + if (skb->len <= skb_tailroom(skb1) && + !tcp_hdr(skb)->fin && + !skb_cloned(skb1)) { NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOALESCE); BUG_ON(skb_copy_bits(skb, 0,
| |