From owner-svn-src-all@FreeBSD.ORG Thu Jan 5 22:29:12 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 413B4106566B; Thu, 5 Jan 2012 22:29:12 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 158B18FC08; Thu, 5 Jan 2012 22:29:12 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q05MTBBf059187; Thu, 5 Jan 2012 22:29:11 GMT (envelope-from jhb@svn.freebsd.org) Received: (from jhb@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q05MTBMf059184; Thu, 5 Jan 2012 22:29:11 GMT (envelope-from jhb@svn.freebsd.org) Message-Id: <201201052229.q05MTBMf059184@svn.freebsd.org> From: John Baldwin Date: Thu, 5 Jan 2012 22:29:11 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r229665 - head/sys/netinet X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jan 2012 22:29:12 -0000 Author: jhb Date: Thu Jan 5 22:29:11 2012 New Revision: 229665 URL: http://svn.freebsd.org/changeset/base/229665 Log: Remove the assertion from tcp_input() that rcv_nxt is always greater than or equal to rcv_adv and fix tcp_twstart() to handle this case by assuming the last window was zero rather than a negative value. The code in tcp_input() already safely handled this case. It can happen due to delayed ACKs along with a remote sender that sends data beyond the window we previously advertised. If we have room in our socket buffer for the extra data beyond the advertised window, we will accept it. However, if the ACK for that segment is delayed, then we will not effectively fixup rcv_adv to account for that extra data until the next segment arrives and forces out an ACK. When that next segment arrives, rcv_nxt will be beyond rcv_adv. Tested by: pjd MFC after: 1 week Modified: head/sys/netinet/tcp_input.c head/sys/netinet/tcp_timewait.c Modified: head/sys/netinet/tcp_input.c ============================================================================== --- head/sys/netinet/tcp_input.c Thu Jan 5 22:28:40 2012 (r229664) +++ head/sys/netinet/tcp_input.c Thu Jan 5 22:29:11 2012 (r229665) @@ -1795,9 +1795,6 @@ tcp_do_segment(struct mbuf *m, struct tc win = sbspace(&so->so_rcv); if (win < 0) win = 0; - KASSERT(SEQ_GEQ(tp->rcv_adv, tp->rcv_nxt), - ("tcp_input negative window: tp %p rcv_nxt %u rcv_adv %u", tp, - tp->rcv_nxt, tp->rcv_adv)); tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); /* Reset receive buffer auto scaling when not in bulk receive mode. */ Modified: head/sys/netinet/tcp_timewait.c ============================================================================== --- head/sys/netinet/tcp_timewait.c Thu Jan 5 22:28:40 2012 (r229664) +++ head/sys/netinet/tcp_timewait.c Thu Jan 5 22:29:11 2012 (r229665) @@ -242,10 +242,10 @@ tcp_twstart(struct tcpcb *tp) /* * Recover last window size sent. */ - KASSERT(SEQ_GEQ(tp->rcv_adv, tp->rcv_nxt), - ("tcp_twstart negative window: tp %p rcv_nxt %u rcv_adv %u", tp, - tp->rcv_nxt, tp->rcv_adv)); - tw->last_win = (tp->rcv_adv - tp->rcv_nxt) >> tp->rcv_scale; + if (SEQ_GE(tp->rcv_adv, tp->rcv_nxt)) + tw->last_win = (tp->rcv_adv - tp->rcv_nxt) >> tp->rcv_scale; + else + tw->last_win = 0; /* * Set t_recent if timestamps are used on the connection.