Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 6 May 2016 01:26:58 +0000 (UTC)
From:      "Jonathan T. Looney" <jtl@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r299146 - stable/10/sys/netinet
Message-ID:  <201605060126.u461QwKA047753@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: jtl
Date: Fri May  6 01:26:58 2016
New Revision: 299146
URL: https://svnweb.freebsd.org/changeset/base/299146

Log:
  MFC r298408:
    Prevent underflows in tp->snd_wnd if the remote side ACKs more than
    tp->snd_wnd. This can happen, for example, when the remote side responds
    to a window probe by ACKing the one byte it contains.

Modified:
  stable/10/sys/netinet/tcp_input.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netinet/tcp_input.c
==============================================================================
--- stable/10/sys/netinet/tcp_input.c	Thu May  5 23:06:39 2016	(r299145)
+++ stable/10/sys/netinet/tcp_input.c	Fri May  6 01:26:58 2016	(r299146)
@@ -2733,6 +2733,9 @@ process_ACK:
 		INP_WLOCK_ASSERT(tp->t_inpcb);
 
 		acked = BYTES_THIS_ACK(tp, th);
+		KASSERT(acked >= 0, ("%s: acked unexepectedly negative "
+		    "(tp->snd_una=%u, th->th_ack=%u, tp=%p, m=%p)", __func__,
+		    tp->snd_una, th->th_ack, tp, m));
 		TCPSTAT_INC(tcps_rcvackpack);
 		TCPSTAT_ADD(tcps_rcvackbyte, acked);
 
@@ -2802,13 +2805,19 @@ process_ACK:
 
 		SOCKBUF_LOCK(&so->so_snd);
 		if (acked > so->so_snd.sb_cc) {
-			tp->snd_wnd -= so->so_snd.sb_cc;
+			if (tp->snd_wnd >= so->so_snd.sb_cc)
+				tp->snd_wnd -= so->so_snd.sb_cc;
+			else
+				tp->snd_wnd = 0;
 			mfree = sbcut_locked(&so->so_snd,
 			    (int)so->so_snd.sb_cc);
 			ourfinisacked = 1;
 		} else {
 			mfree = sbcut_locked(&so->so_snd, acked);
-			tp->snd_wnd -= acked;
+			if (tp->snd_wnd >= (u_long) acked)
+				tp->snd_wnd -= acked;
+			else
+				tp->snd_wnd = 0;
 			ourfinisacked = 0;
 		}
 		/* NB: sowwakeup_locked() does an implicit unlock. */



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605060126.u461QwKA047753>