Re: backport "tcp: fix tcp_mark_head_lost to check skb len before fragmenting" to 4.4-stable?

Yes, it would make sense to backport d88270e ("tcp: fix
tcp_mark_head_lost to check skb len before fragmenting") to
4.4-stable.

It would also work to backport it further (as far back as, e.g. 3.2
stable releases), but (a) the patch would need to resolve conflicts,
since the GFP_ATOMIC parameter is not in older kernels, and (b) it's
only to remove a WARN_ON, so it's probably not worth the effort for
those older kernels, IMHO.

neal

On Mon, Jul 11, 2016 at 5:05 AM, Lennert Buytenhek
[off-list ref] wrote:

Hi!

I am seeing this on 4.4.6-with-some-local-patches:

------------[ cut here ]------------
WARNING: CPU: 5 PID: 117300 at net/ipv4/tcp_output.c:1147 tcp_fragment+0x2d8/0x2e0()
Modules linked in: ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_mangle ip6table_filter ip6table_raw xt_set xt_DSCP xt_TEE nf_dup_ipv4 nf_dup_ipv6 xt_dscp xt_devgroup xt_comment iptable_nat nf_nat_ipv4 nf_nat macvlan ip6_tables msr ip_set_hash_ip ip_set x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul sb_edac input_leds edac_core lpc_ich mfd_core tpm_tis tpm ipmi_watchdog igb i2c_algo_bit isci libsas ixgbe ptp pps_core vxlan udp_tunnel ip6_udp_tunnel mdio
CPU: 5 PID: 117300 Comm: healthcheck-con Tainted: G        W       4.4.6-XXX
Hardware name: Supermicro X9DRi-LN4+/X9DR3-LN4+/X9DRi-LN4+/X9DR3-LN4+, BIOS 3.0a 12/04/2013
 0000000000000000 ffff885eff943788 ffffffff81377011 0000000000000000
 000000000000047b ffff885eff9437c8 ffffffff8107fe07 ffff885eff403500
 ffff885e68e26c00 ffff885c817abc00 00000000000054d8 0000000000005268
Call Trace:
 <IRQ>  [<ffffffff81377011>] dump_stack+0x4d/0x6c
 [<ffffffff8107fe07>] warn_slowpath_common+0x97/0xe0
 [<ffffffff8107fe6a>] warn_slowpath_null+0x1a/0x20
 [<ffffffff816f0ee8>] tcp_fragment+0x2d8/0x2e0
 [<ffffffff816e780b>] tcp_mark_head_lost+0xdb/0x240
 [<ffffffff816e858c>] tcp_update_scoreboard+0x4c/0x70
 [<ffffffff816ec9e1>] tcp_fastretrans_alert+0x761/0xa80
 [<ffffffff816edc83>] tcp_ack+0x933/0x11a0
 [<ffffffff816eeb13>] tcp_rcv_established+0x293/0x750
 [<ffffffff81788ce8>] ? tcp_v4_inbound_md5_hash+0x61/0x152
 [<ffffffff816f89e2>] tcp_v4_do_rcv+0x122/0x220
 [<ffffffff816fa036>] tcp_v4_rcv+0x9a6/0xa80
 [<ffffffff816d567a>] ip_local_deliver_finish+0x9a/0x200
 [<ffffffff816d5994>] ip_local_deliver+0x64/0xd0
 [<ffffffff816d55e0>] ? ip_rcv_finish+0x350/0x350
 [<ffffffff816d53e1>] ip_rcv_finish+0x151/0x350

[...]

This upstream patch seems to address this issue:

commit d88270eef4b56bd7973841dd1fed387ccfa83709
Author: Neal Cardwell [off-list ref]
Date:   Mon Jan 25 14:01:53 2016 -0800

    tcp: fix tcp_mark_head_lost to check skb len before fragmenting

    This commit fixes a corner case in tcp_mark_head_lost() which was
    causing the WARN_ON(len > skb->len) in tcp_fragment() to fire.

    [...]

But it doesn't seem to have been backported to 4.4.  Would it make
sense to backport it to 4.4-stable?

Thanks!


Cheers,
Lennert