Re: [PATCH stable 4.9] tcp: reset sk_send_head in tcp_write_queue_purge

2019-07-30 Thread Sasha Levin
On Tue, Jul 30, 2019 at 09:31:19AM +0800, maowenan wrote: On 2019/7/29 23:32, Sasha Levin wrote: On Mon, Jul 29, 2019 at 09:21:08PM +0800, Mao Wenan wrote: From: Soheil Hassas Yeganeh tcp_write_queue_purge clears all the SKBs in the write queue but does not reset the sk_send_head. As a resu

Re: [PATCH stable 4.9] tcp: reset sk_send_head in tcp_write_queue_purge

2019-07-29 Thread maowenan
On 2019/7/29 23:32, Sasha Levin wrote: > On Mon, Jul 29, 2019 at 09:21:08PM +0800, Mao Wenan wrote: >> From: Soheil Hassas Yeganeh >> >> tcp_write_queue_purge clears all the SKBs in the write queue >> but does not reset the sk_send_head. As a result, we can have >> a NULL pointer dereference an

Re: [PATCH stable 4.9] tcp: reset sk_send_head in tcp_write_queue_purge

2019-07-29 Thread Sasha Levin
On Mon, Jul 29, 2019 at 09:21:08PM +0800, Mao Wenan wrote: From: Soheil Hassas Yeganeh tcp_write_queue_purge clears all the SKBs in the write queue but does not reset the sk_send_head. As a result, we can have a NULL pointer dereference anywhere that we use tcp_send_head instead of the tcp_writ

[PATCH stable 4.9] tcp: reset sk_send_head in tcp_write_queue_purge

2019-07-29 Thread Mao Wenan
From: Soheil Hassas Yeganeh tcp_write_queue_purge clears all the SKBs in the write queue but does not reset the sk_send_head. As a result, we can have a NULL pointer dereference anywhere that we use tcp_send_head instead of the tcp_write_queue_tail. For example, after a27fd7a8ed38 (tcp: purge wr