lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 29 Jan 2010 23:15:54 +0100
From:	Damian Lukowski <>
To:	Netdev <>
Subject: [PATCH 1/3][v2] tcp: fix ICMP-RTO war: Check lower bound

Make sure, that the returned RTO value does not under-run the valid
minimum RTO as given by tcp_rto_min().
Under some circumstances, TCPs srtt and rttvar are zero,
yielding a calculated RTO of zero.
This is particularly unfortunate for ICMP based RTO recalculation
as introduced in f1ecd5d9e736660 (Revert Backoff [v3]: Revert RTO
on ICMP destination unreachable).
Given an initial RTO of zero, the calculation yields zero independent
of icsk_backoff, which results in RTO retransmission flooding.

Reported-by: Denys Fedoryshchenko <>
Signed-off-by: Damian Lukowski <>
 include/net/tcp.h |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 34f5cc2..ff6cbaa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -528,9 +528,12 @@ static inline void tcp_bound_rto(const struct sock *sk)
 		inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
+static inline u32 tcp_rto_min(struct sock *sk);
 static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
-	return (tp->srtt >> 3) + tp->rttvar;
+	u32 rto = (tp->srtt >> 3) + tp->rttvar;
+	u32 min = tcp_rto_min((struct sock *)tp);
+	return unlikely(rto < min) ? min : rto;
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists