Commit 1bd568a0 authored by Eric Dumazet's avatar Eric Dumazet Committed by Zhengchao Shao
Browse files

tcp: refactor tcp_retransmit_timer() 

stable inclusion
from stable-v4.19.318
commit e5a1f7427f97bde4bda73c02106c3bde87696f8f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD4B4
CVE: CVE-2024-41007

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e5a1f7427f97bde4bda73c02106c3bde87696f8f



---------------------------

commit 0d580fbd upstream.

It appears linux-4.14 stable needs a backport of commit
88f8598d ("tcp: exit if nothing to retransmit on RTO timeout")

Since tcp_rtx_queue_empty() is not in pre 4.15 kernels,
let's refactor tcp_retransmit_timer() to only use tcp_rtx_queue_head()

I will provide to stable teams the squashed patches.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent 3a14cc7d

net/ipv4/tcp_timer.c

+8 −2
Original line number Diff line number Diff line
@@ -428,6 +428,7 @@ void tcp_retransmit_timer(struct sock *sk) 
	struct tcp_sock *tp = tcp_sk(sk);

	struct net *net = sock_net(sk);

	struct inet_connection_sock *icsk = inet_csk(sk);

	struct sk_buff *skb;



	if (tp->fastopen_rsk) {

		WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
@@ -438,7 +439,12 @@ void tcp_retransmit_timer(struct sock *sk) 
		 */

		return;

	}

	if (!tp->packets_out || WARN_ON_ONCE(tcp_rtx_queue_empty(sk)))



	if (!tp->packets_out)

		return;



	skb = tcp_rtx_queue_head(sk);

	if (WARN_ON_ONCE(!skb))

		return;



	if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
@@ -470,7 +476,7 @@ void tcp_retransmit_timer(struct sock *sk) 
			goto out;

		}

		tcp_enter_loss(sk);

		tcp_retransmit_skb(sk, tcp_rtx_queue_head(sk), 1);

		tcp_retransmit_skb(sk, skb, 1);

		__sk_dst_reset(sk);

		goto out_reset_timer;

	}