Jon Maxwell 9b415dac50 tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() ... [ Upstream commit cf12e6f912 ] v1: Implement a more general statement as recommended by Eric Dumazet. The sequence number will be advanced, so this check will fix the FIN case and other cases. A customer reported sockets stuck in the CLOSING state. A Vmcore revealed that the write_queue was not empty as determined by tcp_write_queue_empty() but the sk_buff containing the FIN flag had been freed and the socket was zombied in that state. Corresponding pcaps show no FIN from the Linux kernel on the wire. Some instrumentation was added to the kernel and it was found that there is a timing window where tcp_sendmsg() can run after tcp_send_fin(). tcp_sendmsg() will hit an error, for example: 1269 ▹ if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))↩ 1270 ▹ ▹ goto do_error;↩ tcp_remove_empty_skb() will then free the FIN sk_buff as "skb->len == 0". The TCP socket is now wedged in the FIN-WAIT-1 state because the FIN is never sent. If the other side sends a FIN packet the socket will transition to CLOSING and remain that way until the system is rebooted. Fix this by checking for the FIN flag in the sk_buff and don't free it if that is the case. Testing confirmed that fixed the issue. Fixes: fdfc5c8594 ("tcp: remove empty skb from write queue in error cases") Signed-off-by: Jon Maxwell <jmaxwell37@gmail.com> Reported-by: Monir Zouaoui <Monir.Zouaoui@mail.schwarz> Reported-by: Simon Stier <simon.stier@mail.schwarz> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-04-19 16:57:29 +08:00
..
bpfilter
netfilter	netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1	2021-09-28 13:04:55 +02:00
af_inet.c	inet: remove races in inet{6}_getname()	2023-04-19 16:57:14 +08:00
ah4.c
arp.c
bpf_tcp_ca.c
cipso_ipv4.c	net: remove the unnecessary check in cipso_v4_doi_free	2021-09-03 13:52:29 +01:00
datagram.c
devinet.c
esp4.c
esp4_offload.c
fib_frontend.c
fib_lookup.h
fib_notifier.c
fib_rules.c
fib_semantics.c	net: ipv4: Fix rtnexthop len when RTA_FLOW is present	2021-09-24 14:07:10 +01:00
fib_trie.c
fou.c	fou: remove sparse errors	2021-08-31 12:03:33 +01:00
gre_demux.c
gre_offload.c
icmp.c	icmp: fix icmp_ext_echo_iio parsing in icmp_build_probe	2021-10-14 07:54:47 -07:00
igmp.c
inet_connection_sock.c	tcp: switch orphan_count to bare per-cpu counters	2023-04-19 16:57:23 +08:00
inet_diag.c
inet_fragment.c
inet_hashtables.c	tcp: switch orphan_count to bare per-cpu counters	2023-04-19 16:57:23 +08:00
inet_timewait_sock.c
inetpeer.c
ip_forward.c
ip_fragment.c
ip_gre.c	ip_gre: validate csum_start only on pull	2021-09-05 18:59:32 +01:00
ip_input.c
ip_options.c
ip_output.c	net: ipv4: Fix the warning for dereference	2021-08-30 12:47:09 +01:00
ip_sockglue.c	Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers""	2021-09-14 14:24:31 +01:00
ip_tunnel.c
ip_tunnel_core.c
ip_vti.c
ipcomp.c
ipconfig.c
ipip.c
ipmr.c
ipmr_base.c
Kconfig
Makefile
metrics.c
netfilter.c
netlink.c
nexthop.c	nexthop: Fix memory leaks in nexthop notification chain listeners	2021-09-23 12:33:22 +01:00
ping.c	Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers""	2021-09-14 14:24:31 +01:00
proc.c	tcp: switch orphan_count to bare per-cpu counters	2023-04-19 16:57:23 +08:00
protocol.c
raw.c	Revert "Revert "ipv4: fix memory leaks in ip_cmsg_send() callers""	2021-09-14 14:24:31 +01:00
raw_diag.c
route.c	ipv4: fix endianness issue in inet_rtm_getroute_build_skb()	2021-08-31 12:03:03 +01:00
syncookies.c
sysctl_net_ipv4.c
tcp.c	tcp: don't free a FIN sk_buff in tcp_remove_empty_skb()	2023-04-19 16:57:29 +08:00
tcp_bbr.c
tcp_bic.c
tcp_bpf.c	skmsg: Extract and reuse sk_msg_is_readable()	2021-10-26 12:29:33 -07:00
tcp_cdg.c
tcp_cong.c
tcp_cubic.c
tcp_dctcp.c
tcp_dctcp.h
tcp_diag.c
tcp_fastopen.c
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c	tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()	2021-09-14 14:23:09 +01:00
tcp_ipv4.c	tcp: md5: Allow MD5SIG_FLAG_IFINDEX with ifindex=0	2021-10-15 14:36:57 +01:00
tcp_lp.c
tcp_metrics.c
tcp_minisocks.c
tcp_nv.c
tcp_offload.c
tcp_output.c
tcp_rate.c
tcp_recovery.c
tcp_scalable.c
tcp_timer.c
tcp_ulp.c
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tunnel4.c
udp.c	net: Implement ->sock_is_readable() for UDP and AF_UNIX	2021-10-26 12:29:33 -07:00
udp_bpf.c	net: Implement ->sock_is_readable() for UDP and AF_UNIX	2021-10-26 12:29:33 -07:00
udp_diag.c
udp_impl.h
udp_offload.c	fou: remove sparse errors	2021-08-31 12:03:33 +01:00
udp_tunnel_core.c
udp_tunnel_nic.c	udp_tunnel: Fix udp_tunnel_nic work-queue type	2021-09-13 12:38:45 +01:00
udp_tunnel_stub.c
udplite.c
xfrm4_input.c
xfrm4_output.c
xfrm4_policy.c
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c