On Tue, May 15, 2018 at 12:14 AM Eric Dumazet <eduma...@google.com> wrote:
> syzkaller found a reliable way to crash the host, hitting a BUG()
> in __tcp_retransmit_skb()
> Malicous MSG_FASTOPEN is the root cause. We need to purge write queue
> in tcp_connect_init() at the point we init snd_una/write_seq.
> This patch also replaces the BUG() by a less intrusive WARN_ON_ONCE()
> kernel BUG at net/ipv4/tcp_output.c:2837!
...
> Fixes: cf60af03ca4e ("net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Cc: Yuchung Cheng <ych...@google.com>
> Cc: Neal Cardwell <ncardw...@google.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
> ---
Acked-by: Neal Cardwell <ncardw...@google.com>
Thanks, Eric!
neal
