Date: Fri, 6 May 2016 01:26:58 +0000 (UTC) From: "Jonathan T. Looney" <jtl@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r299146 - stable/10/sys/netinet Message-ID: <201605060126.u461QwKA047753@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jtl Date: Fri May 6 01:26:58 2016 New Revision: 299146 URL: https://svnweb.freebsd.org/changeset/base/299146 Log: MFC r298408: Prevent underflows in tp->snd_wnd if the remote side ACKs more than tp->snd_wnd. This can happen, for example, when the remote side responds to a window probe by ACKing the one byte it contains. Modified: stable/10/sys/netinet/tcp_input.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/netinet/tcp_input.c ============================================================================== --- stable/10/sys/netinet/tcp_input.c Thu May 5 23:06:39 2016 (r299145) +++ stable/10/sys/netinet/tcp_input.c Fri May 6 01:26:58 2016 (r299146) @@ -2733,6 +2733,9 @@ process_ACK: INP_WLOCK_ASSERT(tp->t_inpcb); acked = BYTES_THIS_ACK(tp, th); + KASSERT(acked >= 0, ("%s: acked unexepectedly negative " + "(tp->snd_una=%u, th->th_ack=%u, tp=%p, m=%p)", __func__, + tp->snd_una, th->th_ack, tp, m)); TCPSTAT_INC(tcps_rcvackpack); TCPSTAT_ADD(tcps_rcvackbyte, acked); @@ -2802,13 +2805,19 @@ process_ACK: SOCKBUF_LOCK(&so->so_snd); if (acked > so->so_snd.sb_cc) { - tp->snd_wnd -= so->so_snd.sb_cc; + if (tp->snd_wnd >= so->so_snd.sb_cc) + tp->snd_wnd -= so->so_snd.sb_cc; + else + tp->snd_wnd = 0; mfree = sbcut_locked(&so->so_snd, (int)so->so_snd.sb_cc); ourfinisacked = 1; } else { mfree = sbcut_locked(&so->so_snd, acked); - tp->snd_wnd -= acked; + if (tp->snd_wnd >= (u_long) acked) + tp->snd_wnd -= acked; + else + tp->snd_wnd = 0; ourfinisacked = 0; } /* NB: sowwakeup_locked() does an implicit unlock. */
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605060126.u461QwKA047753>