From: Eric Dumazet <eric.duma...@gmail.com>
Date: Tue, 13 Sep 2016 22:55:05 -0700
> From: Eric Dumazet <eduma...@google.com>
>
> When skb replaces another one in ooo queue, I forgot to also
> update tp->ooo_last_skb as well, if the replaced skb was the last one
> in the queue.
>
> To fix this, we simply can re-use the code that runs after an insertion,
> trying to merge skbs at the right of current skb.
>
> This not only fixes the bug, but also remove all small skbs that might
> be a subset of the new one.
>
> Example:
>
> We receive segments 2001:3001, 4001:5001
>
> Then we receive 2001:8001 : We should replace 2001:3001 with the big
> skb, but also remove 4001:50001 from the queue to save space.
>
> packetdrill test demonstrating the bug
...
> Fixes: 9f5afeae5152 ("tcp: use an RB tree for ooo receive queue")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Reported-by: Yuchung Cheng <ych...@google.com>
Applied.
