From: Eric Dumazet <eric.duma...@gmail.com>
Date: Thu, 02 Nov 2017 18:10:03 -0700
> From: Eric Dumazet <eduma...@google.com>
>
> While stress testing MTU probing, we had crashes in list_del() that we
> root-caused
> to the fact that tcp_fragment() is unconditionally inserting the freshly
> allocated
> skb into tsorted_sent_queue list.
>
> But this list is supposed to contain skbs that were sent.
> This was mostly harmless until MTU probing was enabled.
>
> Fortunately we can use the tcp_queue enum added later (but in same linux
> version)
> for rtx-rb-tree to fix the bug.
>
> Fixes: e2080072ed2d ("tcp: new list for sent but unacked skbs for RACK
> recovery")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
Applied, thanks Eric.
