tcp: clear xmit timers in tcp_v4_syn_recv_sock()
authorEric Dumazet <eric.dumazet@gmail.com>
Mon, 14 Nov 2011 10:56:56 +0000 (10:56 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 16 Nov 2011 21:57:45 +0000 (16:57 -0500)
Simon Kirby reported divides by zero errors in __tcp_select_window()

This happens when inet_csk_route_child_sock() returns a NULL pointer :

We free new socket while we eventually armed keepalive timer in
tcp_create_openreq_child()

Fix this by a call to tcp_clear_xmit_timers()

[ This is a followup to commit 918eb39962dff (net: add missing
bh_unlock_sock() calls) ]

Reported-by: Simon Kirby <sim@hostway.ca>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Simon Kirby <sim@hostway.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/tcp_ipv4.c

index a7443159c400450e73ff9b83230fe40a48d0da39..a9db4b1a22156dc944addbf661187b2e71070875 100644 (file)
@@ -1510,6 +1510,7 @@ exit:
        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
        return NULL;
 put_and_exit:
+       tcp_clear_xmit_timers(newsk);
        bh_unlock_sock(newsk);
        sock_put(newsk);
        goto exit;