Yuchung Cheng ed7748bcf2 tcp: fix NULL ref in tail loss probe
[ Upstream commit b2b7af861122a0c0f6260155c29a1b2e594cd5b5 ]

TCP loss probe timer may fire when the retranmission queue is empty but
has a non-zero tp->packets_out counter. tcp_send_loss_probe will call
tcp_rearm_rto which triggers NULL pointer reference by fetching the
retranmission queue head in its sub-routines.

Add a more detailed warning to help catch the root cause of the inflight
accounting inconsistency.

Reported-by: Rafael Tinoco <rafael.tinoco@linaro.org>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-12-17 21:55:09 +01:00
..
2018-05-16 10:06:51 +02:00
2015-11-23 14:56:15 -05:00
2018-12-17 21:55:09 +01:00
2015-10-07 04:27:43 -07:00
2018-12-01 09:46:34 +01:00
2018-11-10 07:41:34 -08:00
2018-02-25 11:03:37 +01:00
2018-11-10 07:41:41 -08:00