linux/net/ipv4
Ilpo Järvinen dc6330590f tcp: fix crash in tcp_xmit_retransmit_queue
commit 45e77d3145 upstream.

It can happen that there are no packets in queue while calling
tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns
NULL and that gets deref'ed to get sacked into a local var.

There is no work to do if no packets are outstanding so we just
exit early.

This oops was introduced by 08ebd1721a (tcp: remove tp->lost_out
guard to make joining diff nicer).

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Reported-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de>
Tested-by: Lennart Schulte <lennart.schulte@nets.rwth-aachen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-08-02 10:20:53 -07:00
..
netfilter netfilter: nf_conntrack: fix hash resizing with namespaces 2010-02-23 07:37:53 -08:00
af_inet.c net: Use sk_mark for routing lookup in more places 2009-10-01 15:16:49 -07:00
ah4.c net: constify struct net_protocol 2009-09-14 17:03:01 -07:00
arp.c net: make neigh_ops constant 2009-09-01 17:40:57 -07:00
cipso_ipv4.c
datagram.c
devinet.c net: Fix sysctl restarts... 2010-03-15 08:49:38 -07:00
esp4.c net: constify struct net_protocol 2009-09-14 17:03:01 -07:00
fib_frontend.c net: restore ip source validation 2010-02-09 04:50:55 -08:00
fib_hash.c
fib_lookup.h
fib_rules.c
fib_semantics.c
fib_trie.c fib_trie: resize rework 2009-08-28 23:57:15 -07:00
icmp.c net: constify struct net_protocol 2009-09-14 17:03:01 -07:00
igmp.c inet: Remove bogus IGMPv3 report handling 2010-03-15 08:49:39 -07:00
inet_connection_sock.c tcp: reduce SYN-ACK retrans for TCP_DEFER_ACCEPT 2009-10-19 19:19:03 -07:00
inet_diag.c
inet_fragment.c
inet_hashtables.c
inet_lro.c
inet_timewait_sock.c tcp: fix premature termination of FIN_WAIT2 time-wait sockets 2009-08-29 00:00:35 -07:00
inetpeer.c
ip_forward.c
ip_fragment.c ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS 2009-11-29 23:02:22 -08:00
ip_gre.c gre: Fix dev_addr clobbering for gretap 2009-10-30 12:28:07 -07:00
ip_input.c net: constify struct net_protocol 2009-09-14 17:03:01 -07:00
ip_options.c
ip_output.c ip_fragment: also adjust skb->truesize for packets not owned by a socket 2009-12-18 14:05:05 -08:00
ip_sockglue.c net: Fix IP_MULTICAST_IF 2009-10-19 21:34:20 -07:00
ipcomp.c net: constify struct net_protocol 2009-09-14 17:03:01 -07:00
ipconfig.c
ipip.c ipip: Fix handling of DF packets when pmtudisc is OFF 2009-11-06 20:33:40 -08:00
ipmr.c ipmr: missing dev_put() on error path in vif_add() 2009-11-13 19:56:54 -08:00
Kconfig
Makefile
netfilter.c
proc.c
protocol.c net: constify struct net_protocol 2009-09-14 17:03:01 -07:00
raw.c AF_RAW: Augment raw_send_hdrinc to expand skb to fit iphdr->ihl (v2) 2009-10-29 01:09:58 -07:00
route.c net: Fix RPF to work with policy routing 2009-10-29 22:49:12 -07:00
syncookies.c
sysctl_net_ipv4.c sysctl: remove "struct file *" argument of ->proc_handler 2009-09-24 07:21:04 -07:00
tcp_bic.c
tcp_cong.c
tcp_cubic.c
tcp_diag.c
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c tcp: fix ICMP-RTO war 2010-04-26 07:41:34 -07:00
tcp_ipv4.c tcp: fix ssthresh u16 leftover 2009-09-15 01:30:10 -07:00
tcp_lp.c
tcp_minisocks.c tcp: accept socket after TCP_DEFER_ACCEPT period 2009-10-19 19:19:01 -07:00
tcp_output.c tcp: fix crash in tcp_xmit_retransmit_queue 2010-08-02 10:20:53 -07:00
tcp_probe.c
tcp_scalable.c
tcp_timer.c Revert Backoff [v3]: Calculate TCP's connection close threshold as a time value. 2009-09-01 02:45:47 -07:00
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tcp.c tcp: provide more information on the tcp receive_queue bugs 2009-11-13 13:56:33 -08:00
tunnel4.c net: constify struct net_protocol 2009-09-14 17:03:01 -07:00
udp_impl.h net: Make setsockopt() optlen be unsigned. 2009-09-30 16:12:20 -07:00
udp.c ipv4: udp: fix short packet and bad checksum logging 2010-05-26 14:29:13 -07:00
udplite.c net: constify struct net_protocol 2009-09-14 17:03:01 -07:00
xfrm4_input.c
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_state.c
xfrm4_tunnel.c