From: Eric Dumazet <[email protected]>
Date: Mon, 14 May 2018 21:14:26 -0700
> syzkaller found a reliable way to crash the host, hitting a BUG()
> in __tcp_retransmit_skb()
>
> Malicous MSG_FASTOPEN is the root cause. We need to purge write queue
> in tcp_connect_init() at the point we init snd_una/write_seq.
>
> This patch also replaces the BUG() by a less intrusive WARN_ON_ONCE()
...
> Fixes: cf60af03ca4e ("net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)")
> Signed-off-by: Eric Dumazet <[email protected]>
> Cc: Yuchung Cheng <[email protected]>
> Cc: Neal Cardwell <[email protected]>
> Reported-by: syzbot <[email protected]>
Applied and queued up for -stable, thanks Eric.
