Package: src:linux
Version: 3.16
Severity: important
Tags: patch
Dear Kernel team,
There is a bug with TCP in kernel 3.16 described as:
"Some drivers are unable to perform TX completions in a bound time.
They instead call skb_orphan()
Problem is skb_fclone_busy() has to detect this case, otherwise
we block TCP retransmits and can freeze unlucky tcp sessions on
mostly idle hosts."
This bug is likely to surface userland, affects several drivers, and is sender-side only:
# git grep -n skb_orphan -- drivers/net
drivers/net/ethernet/chelsio/cxgb3/sge.c:1313: skb_orphan(skb);
drivers/net/ethernet/chelsio/cxgb4/sge.c:1167: skb_orphan(skb);
drivers/net/ethernet/chelsio/cxgb4vf/sge.c:1337: skb_orphan(skb);
drivers/net/ethernet/sun/niu.c:6674: skb_orphan(skb);
drivers/net/loopback.c:77: skb_orphan(skb);
drivers/net/tun.c:789: if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
drivers/net/tun.c:800: skb_orphan(skb);
drivers/net/virtio_net.c:938: skb_orphan(skb);
drivers/net/wireless/ath/wil6210/txrx.c:532: skb_orphan(skb);
drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c:718: skb_orphan(skb);
drivers/net/wireless/libertas/tx.c:156: skb_orphan(skb);
drivers/net/wireless/mac80211_hwsim.c:992: skb_orphan(skb);
Google engineer also states that backported patch for 3.16 or 3.17 kernel is much simpler :
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 4e4932b5079b..a8794367cd20 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2082,7 +2082,8 @@ static bool skb_still_in_host_queue(const struct sock *sk,
const struct sk_buff *fclone = skb + 1;
if (unlikely(skb->fclone == SKB_FCLONE_ORIG &&
- fclone->fclone == SKB_FCLONE_CLONE)) {
+ fclone->fclone == SKB_FCLONE_CLONE &&
+ fclone->sk == sk)) {
NET_INC_STATS_BH(sock_net(sk),
LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
return true;
Understandably very bad timing but ideally this should be addressed in Jessie now versus a later backports update.
Thank you,
Eric