From: Eric Dumazet <eduma...@google.com>
Date: Mon, 14 May 2018 21:14:26 -0700
> syzkaller found a reliable way to crash the host, hitting a BUG()
> in __tcp_retransmit_skb()
>
> Malicous MSG_FASTOPEN is the root cause. We need to purge write queue
> in tcp_connect_init() at the point we init snd_una/write_seq.
>
> This patch also replaces the BUG() by a less intrusive WARN_ON_ONCE()
...
> Fixes: cf60af03ca4e ("net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Cc: Yuchung Cheng <ych...@google.com>
> Cc: Neal Cardwell <ncardw...@google.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
Applied and queued up for -stable, thanks Eric.
