This is a note to let you know that I've just added the patch titled tcp: do not send empty skb from tcp_write_xmit() to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Wed 01 Jan 2020 10:35:31 PM CET From: Eric Dumazet <edumazet@xxxxxxxxxx> Date: Thu, 12 Dec 2019 12:55:29 -0800 Subject: tcp: do not send empty skb from tcp_write_xmit() From: Eric Dumazet <edumazet@xxxxxxxxxx> [ Upstream commit 1f85e6267caca44b30c54711652b0726fadbb131 ] Backport of commit fdfc5c8594c2 ("tcp: remove empty skb from write queue in error cases") in linux-4.14 stable triggered various bugs. One of them has been fixed in commit ba2ddb43f270 ("tcp: Don't dequeue SYN/FIN-segments from write-queue"), but we still have crashes in some occasions. Root-cause is that when tcp_sendmsg() has allocated a fresh skb and could not append a fragment before being blocked in sk_stream_wait_memory(), tcp_write_xmit() might be called and decide to send this fresh and empty skb. Sending an empty packet is not only silly, it might have caused many issues we had in the past with tp->packets_out being out of sync. Fixes: c65f7f00c587 ("[TCP]: Simplify SKB data portion allocation with NETIF_F_SG.") Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> Cc: Christoph Paasch <cpaasch@xxxxxxxxx> Acked-by: Neal Cardwell <ncardwell@xxxxxxxxxx> Cc: Jason Baron <jbaron@xxxxxxxxxx> Acked-by: Soheil Hassas Yeganeh <soheil@xxxxxxxxxx> Signed-off-by: Jakub Kicinski <jakub.kicinski@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/ipv4/tcp_output.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2441,6 +2441,14 @@ static bool tcp_write_xmit(struct sock * if (tcp_small_queue_check(sk, skb, 0)) break; + /* Argh, we hit an empty skb(), presumably a thread + * is sleeping in sendmsg()/sk_stream_wait_memory(). + * We do not want to send a pure-ack packet and have + * a strange looking rtx queue with empty packet(s). + */ + if (TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) + break; + if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp))) break; Patches currently in stable-queue which might be from edumazet@xxxxxxxxxx are queue-5.4/net_sched-sch_fq-properly-set-sk-sk_pacing_status.patch queue-5.4/net-icmp-fix-data-race-in-cmp_global_allow.patch queue-5.4/dma-debug-add-a-schedule-point-in-debug_dma_dump_map.patch queue-5.4/tcp-dccp-fix-possible-race-__inet_lookup_established.patch queue-5.4/net-add-a-read_once-in-skb_peek_tail.patch queue-5.4/inetpeer-fix-data-race-in-inet_putpeer-inet_putpeer.patch queue-5.4/tcp-do-not-send-empty-skb-from-tcp_write_xmit.patch queue-5.4/netfilter-bridge-make-sure-to-pull-arp-header-in-br_nf_forward_arp.patch queue-5.4/6pack-mkiss-fix-possible-deadlock.patch queue-5.4/tcp-fix-highest_sack-and-highest_sack_seq.patch queue-5.4/hrtimer-annotate-lockless-access-to-timer-state.patch