On Thu, Nov 2, 2017 at 9:10 PM, Eric Dumazet <eric.duma...@gmail.com> wrote:
> From: Eric Dumazet <eduma...@google.com>
>
> While stress testing MTU probing, we had crashes in list_del() that we
> root-caused
> to the fact that tcp_fragment() is unconditionally inserting the freshly
> allocated
> skb into tsorted_sent_queue list.
>
> But this list is supposed to contain skbs that were sent.
> This was mostly harmless until MTU probing was enabled.
>
> Fortunately we can use the tcp_queue enum added later (but in same linux
> version)
> for rtx-rb-tree to fix the bug.
>
> Fixes: e2080072ed2d ("tcp: new list for sent but unacked skbs for RACK
> recovery")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
Acked-by: Neal Cardwell <ncardw...@google.com>
Thanks, Eric!
neal
