net: fix incorrect backport of tcp_send_fin in 2.6.32.66

Eric forwarded this bug report happening since 2.6.32.66, found that the
backport of commit 845704a5 ("tcp: avoid looping in tcp_send_fin()") was
incorrect and proposed this patch to fix it. The bug was also reported by
starlight.2015q2@binnacle.cx who confirmed the fix.

> Date: Fri, 29 May 2015 09:12:45 +0000
> From: "bugzilla-daemon@bugzilla.kernel.org" <bugzilla-daemon@bugzilla.kernel.org>
> To: "shemminger@linux-foundation.org" <shemminger@linux-foundation.org>
> Subject: [Bug 99161] New: 2.6.32.66 PPC Oops in tcp_send_fin
>
>
> https://bugzilla.kernel.org/show_bug.cgi?id=99161
>
>             Bug ID: 99161
>            Summary: 2.6.32.66 PPC Oops in tcp_send_fin
>            Product: Networking
>            Version: 2.5
>     Kernel Version: 2.6.32.66
>           Hardware: PPC-32
>                 OS: Linux
>               Tree: Mainline
>             Status: NEW
>           Severity: normal
>           Priority: P1
>          Component: IPV4
>           Assignee: shemminger@linux-foundation.org
>           Reporter: varenet@parisc-linux.org
>         Regression: No
>
> I just updated my trusty old PPC box to longterm 2.6.32.66 (was running .65
> before that with zero issue) and it started spewing oopses at me like hell
> broke loose. This machine is primarily used as a DNS and MX (albeit under low
> pressure).
(...)

Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5339f066234b6fc36d036f458b9af2898bb1c0d7..d1e2895bb63c3748c406661fae42e74974ffbbfe 100644 (file)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2136,7 +2136,7 @@ void tcp_send_fin(struct sock *sk)
         */
        if (tskb && (tcp_send_head(sk) || tcp_memory_pressure)) {
 coalesce:
-               TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_FIN;
+               TCP_SKB_CB(tskb)->flags |= TCPCB_FLAG_FIN;
                TCP_SKB_CB(tskb)->end_seq++;
                tp->write_seq++;
                if (!tcp_send_head(sk)) {