From patchwork Mon May 15 21:05:47 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Soheil Hassas Yeganeh X-Patchwork-Id: 762725 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3wRY5Z6GWFz9s7B for ; Tue, 16 May 2017 07:05:54 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="XH0Fo7JH"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757614AbdEOVFx (ORCPT ); Mon, 15 May 2017 17:05:53 -0400 Received: from mail-qt0-f195.google.com ([209.85.216.195]:33560 "EHLO mail-qt0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756248AbdEOVFv (ORCPT ); Mon, 15 May 2017 17:05:51 -0400 Received: by mail-qt0-f195.google.com with SMTP id a46so17859269qte.0 for ; Mon, 15 May 2017 14:05:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=/v/CVEuTyER0qdDANOBQ+39OS4+KWLU35wH/MU9kPnk=; b=XH0Fo7JHsrYA72qXzUVIyQunpSWk2sdjd1kaxxt0l5MaOJHksCypZ6uAH5VZkc2dgi 6qwyugFUzYiV8Nj5fkfcTYO0F96rgPyH4nBrjt8m6yo6O9SPgs/3tttZzhOEqMmwFGlL Oea/Z6i19QkXWWxOBWbNiYa3seyCAImUwTlPZwKIfYwXW2776k7GTYavCttULcVdrO+8 vJ0GJHeDdtnEXj7BM1zr00/sl1a9/73T2OIyvJHxhRREHxNQAMAMATIogXrKsrz7HfTb jz9udhTdmEIp6j7H6Zz1f4hQse0cwiWnLR3lnLUID2z1n9qttsBbB+/Wlr0bsKn6kH7L 5dyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=/v/CVEuTyER0qdDANOBQ+39OS4+KWLU35wH/MU9kPnk=; b=o48XCzMJKcASILNCMDC2yCtc4NYcZJHktPFP8p9rGHnA0NxQ9hgpa96Rbq9Ze38Ocl TpkMOA/upb65R+jlUiT4BrLpjwYbwwuPXt5YXkiutc3lkG7vmTop7qS4DH8prUirMcpI hkwAH4mYNJjtALBQFoTB7aUS58d1j/gEfb+W8xNaYyYOP6gQ0NGYesEGeNHvxcsyi6Y0 Uz0Wy8C3r85OgzJsuf0B2iPihX2ljzPiuw7JTCtQ0B2TeWi193hsEZtO6A6VKaCNjjeQ TbfjAuYc8/L8bJq4EcljLkr6lihA5M0qPEZFYY4ljqAtXnv6WSHEttst5dkTCPY6dE4Q WIZg== X-Gm-Message-State: AODbwcAGQEKQDRfrgr7R15oCkbLeBO3Xo9hJovFjpRmnimub8M45xk9x 2M8kRK55fBR0hg== X-Received: by 10.200.42.28 with SMTP id k28mr8334418qtk.40.1494882350983; Mon, 15 May 2017 14:05:50 -0700 (PDT) Received: from z.nyc.corp.google.com ([172.26.104.94]) by smtp.gmail.com with ESMTPSA id r26sm9433147qta.0.2017.05.15.14.05.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 15 May 2017 14:05:50 -0700 (PDT) From: Soheil Hassas Yeganeh To: davem@davemloft.net, netdev@vger.kernel.org Cc: ilpo.jarvinen@helsinki.fi, Soheil Hassas Yeganeh , Neal Cardwell , Yuchung Cheng , Eric Dumazet Subject: [PATCH net] tcp: eliminate negative reordering in tcp_clean_rtx_queue Date: Mon, 15 May 2017 17:05:47 -0400 Message-Id: <20170515210547.125052-1-soheil.kdev@gmail.com> X-Mailer: git-send-email 2.13.0.rc2.291.g57267f2277-goog Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Soheil Hassas Yeganeh tcp_ack() can call tcp_fragment() which may dededuct the value tp->fackets_out when MSS changes. When prior_fackets is larger than tp->fackets_out, tcp_clean_rtx_queue() can invoke tcp_update_reordering() with negative values. This results in absurd tp->reodering values higher than sysctl_tcp_max_reordering. Note that tcp_update_reordering indeeds sets tp->reordering to min(sysctl_tcp_max_reordering, metric), but because the comparison is signed, a negative metric always wins. Fixes: c7caf8d3ed7a ("[TCP]: Fix reord detection due to snd_una covered holes") Reported-by: Rebecca Isaacs Signed-off-by: Soheil Hassas Yeganeh Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 9739962bfb3f..f27dff64e59e 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3190,7 +3190,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets, int delta; /* Non-retransmitted hole got filled? That's reordering */ - if (reord < prior_fackets) + if (reord < prior_fackets && reord <= tp->fackets_out) tcp_update_reordering(sk, tp->fackets_out - reord, 0); delta = tcp_is_fack(tp) ? pkts_acked :