On Tue, May 15, 2018 at 12:14 AM Eric Dumazet <[email protected]> wrote:
> syzkaller found a reliable way to crash the host, hitting a BUG()
> in __tcp_retransmit_skb()
> Malicous MSG_FASTOPEN is the root cause. We need to purge write queue
> in tcp_connect_init() at the point we init snd_una/write_seq.
> This patch also replaces the BUG() by a less intrusive WARN_ON_ONCE()
> kernel BUG at net/ipv4/tcp_output.c:2837!
...
> Fixes: cf60af03ca4e ("net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)")
> Signed-off-by: Eric Dumazet <[email protected]>
> Cc: Yuchung Cheng <[email protected]>
> Cc: Neal Cardwell <[email protected]>
> Reported-by: syzbot <[email protected]>
> ---
Acked-by: Neal Cardwell <[email protected]>
Thanks, Eric!
neal
