lkml.org 
[lkml]   [2018]   [Jun]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 31/52] tcp: avoid integer overflows in tcp_rcv_space_adjust()
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Dumazet <edumazet@google.com>

    commit 607065bad9931e72207b0cac365d7d4abc06bd99 upstream.

    When using large tcp_rmem[2] values (I did tests with 500 MB),
    I noticed overflows while computing rcvwin.

    Lets fix this before the following patch.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
    Acked-by: Wei Wang <weiwan@google.com>
    Acked-by: Neal Cardwell <ncardwell@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    [Backport: sysctl_tcp_rmem is not Namespace-ify'd in older kernels]
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    include/linux/tcp.h | 2 +-
    net/ipv4/tcp_input.c | 10 ++++++----
    2 files changed, 7 insertions(+), 5 deletions(-)

    --- a/include/linux/tcp.h
    +++ b/include/linux/tcp.h
    @@ -334,7 +334,7 @@ struct tcp_sock {

    /* Receiver queue space */
    struct {
    - int space;
    + u32 space;
    u32 seq;
    u64 time;
    } rcvq_space;
    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -591,8 +591,8 @@ static inline void tcp_rcv_rtt_measure_t
    void tcp_rcv_space_adjust(struct sock *sk)
    {
    struct tcp_sock *tp = tcp_sk(sk);
    + u32 copied;
    int time;
    - int copied;

    tcp_mstamp_refresh(tp);
    time = tcp_stamp_us_delta(tp->tcp_mstamp, tp->rcvq_space.time);
    @@ -615,12 +615,13 @@ void tcp_rcv_space_adjust(struct sock *s

    if (sysctl_tcp_moderate_rcvbuf &&
    !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) {
    - int rcvwin, rcvmem, rcvbuf;
    + int rcvmem, rcvbuf;
    + u64 rcvwin;

    /* minimal window to cope with packet losses, assuming
    * steady state. Add some cushion because of small variations.
    */
    - rcvwin = (copied << 1) + 16 * tp->advmss;
    + rcvwin = ((u64)copied << 1) + 16 * tp->advmss;

    /* If rate increased by 25%,
    * assume slow start, rcvwin = 3 * copied
    @@ -640,7 +641,8 @@ void tcp_rcv_space_adjust(struct sock *s
    while (tcp_win_from_space(rcvmem) < tp->advmss)
    rcvmem += 128;

    - rcvbuf = min(rcvwin / tp->advmss * rcvmem, sysctl_tcp_rmem[2]);
    + do_div(rcvwin, tp->advmss);
    + rcvbuf = min_t(u64, rcvwin * rcvmem, sysctl_tcp_rmem[2]);
    if (rcvbuf > sk->sk_rcvbuf) {
    sk->sk_rcvbuf = rcvbuf;


    \
     
     \ /
      Last update: 2018-06-04 09:26    [W:3.292 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site