diff options
| author |   Eric Dumazet <edumazet@google.com> | 2014-09-22 13:19:44 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2014-09-22 16:27:10 -0400 |
| commit | fcdd1cf4dd63aecf86c987d7f4ec7187be5c2fbc (patch) | |
| tree | 9f74f24f8fe931ffac65805a30bf7e53de7e89b1 /net/ipv4/tcp_input.c | |
| parent | ipv6: mld: answer mldv2 queries with mldv1 reports in mldv1 fallback (diff) | |
| download | linux-dev-fcdd1cf4dd63aecf86c987d7f4ec7187be5c2fbc.tar.xz linux-dev-fcdd1cf4dd63aecf86c987d7f4ec7187be5c2fbc.zip | |
tcp: avoid possible arithmetic overflows
icsk_rto is a 32bit field, and icsk_backoff can reach 15 by default,
or more if some sysctl (eg tcp_retries2) are changed.
Better use 64bit to perform icsk_rto << icsk_backoff operations
As Joe Perches suggested, add a helper for this.
Yuchung spotted the tcp_v4_err() case.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/tcp_input.c')
| -rw-r--r-- | net/ipv4/tcp_input.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 02fb66d4a018..13f3da4762e3 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3208,9 +3208,10 @@ static void tcp_ack_probe(struct sock *sk) * This function is not for random using! */ } else { + unsigned long when = inet_csk_rto_backoff(icsk, TCP_RTO_MAX); + inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0, - min(icsk->icsk_rto << icsk->icsk_backoff, TCP_RTO_MAX), - TCP_RTO_MAX); + when, TCP_RTO_MAX); } } |