netdev - [PATCH 1/3][v2] tcp: fix ICMP-RTO war: Check lower bound

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <4B635E1A.7040100@tvk.rwth-aachen.de>
Date:	Fri, 29 Jan 2010 23:15:54 +0100
From:	Damian Lukowski <damian@....rwth-aachen.de>
To:	Netdev <netdev@...r.kernel.org>
Subject: [PATCH 1/3][v2] tcp: fix ICMP-RTO war: Check lower bound

Make sure, that the returned RTO value does not under-run the valid
minimum RTO as given by tcp_rto_min().
Under some circumstances, TCPs srtt and rttvar are zero,
yielding a calculated RTO of zero.
This is particularly unfortunate for ICMP based RTO recalculation
as introduced in f1ecd5d9e736660 (Revert Backoff [v3]: Revert RTO
on ICMP destination unreachable).
Given an initial RTO of zero, the calculation yields zero independent
of icsk_backoff, which results in RTO retransmission flooding.

Reported-by: Denys Fedoryshchenko <denys@...p.net.lb>
Signed-off-by: Damian Lukowski <damian@....rwth-aachen.de>
---
 include/net/tcp.h |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 34f5cc2..ff6cbaa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -528,9 +528,12 @@ static inline void tcp_bound_rto(const struct sock *sk)
 		inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
 }
 
+static inline u32 tcp_rto_min(struct sock *sk);
 static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
 {
-	return (tp->srtt >> 3) + tp->rttvar;
+	u32 rto = (tp->srtt >> 3) + tp->rttvar;
+	u32 min = tcp_rto_min((struct sock *)tp);
+	return unlikely(rto < min) ? min : rto;
 }
 
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)
-- 
1.6.4.4
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html