evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tcp: Overflow bug in Vegas

Browse source 
From: Lachlan Andrew <lachlan.andrew@gmail.com>

There is an overflow bug in net/ipv4/tcp_vegas.c for large BDPs
(e.g. 400Mbit/s, 400ms).  The multiplication (old_wnd *
vegas->baseRTT) << V_PARAM_SHIFT overflows a u32.

[ Fix tcp_veno.c too, it has similar calculations. -DaveM ]

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Lachlan Andrew 2008-04-30 01:04:03 -07:00 • committed by David S. Miller
parent be9164e769
commit 159131149c
2 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
net/ipv4/tcp_vegas.c
View file

@ -229,7 +229,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
*/ */
tcp_reno_cong_avoid(sk, ack, in_flight); tcp_reno_cong_avoid(sk, ack, in_flight);
} else { } else {
u32 rtt, target_cwnd, diff; u32 rtt, diff;
u64 target_cwnd;
/* We have enough RTT samples, so, using the Vegas /* We have enough RTT samples, so, using the Vegas
* algorithm, we determine if we should increase or * algorithm, we determine if we should increase or
@ -252,8 +253,9 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
* We keep it as a fixed point number with * We keep it as a fixed point number with
* V_PARAM_SHIFT bits to the right of the binary point. * V_PARAM_SHIFT bits to the right of the binary point.
*/ */
target_cwnd = ((old_wnd * vegas->baseRTT) target_cwnd = ((u64)old_wnd * vegas->baseRTT);
<< V_PARAM_SHIFT) / rtt; target_cwnd <<= V_PARAM_SHIFT;
do_div(target_cwnd, rtt);
/* Calculate the difference between the window we had, /* Calculate the difference between the window we had,
* and the window we would like to have. This quantity * and the window we would like to have. This quantity
@ -279,7 +281,7 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
* utilization. * utilization.
*/ */
tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_cwnd = min(tp->snd_cwnd,
(target_cwnd >> ((u32)target_cwnd >>
V_PARAM_SHIFT)+1); V_PARAM_SHIFT)+1);
} else if (tp->snd_cwnd <= tp->snd_ssthresh) { } else if (tp->snd_cwnd <= tp->snd_ssthresh) {

8
net/ipv4/tcp_veno.c
View file

@ -133,7 +133,8 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
*/ */
tcp_reno_cong_avoid(sk, ack, in_flight); tcp_reno_cong_avoid(sk, ack, in_flight);
} else { } else {
u32 rtt, target_cwnd; u64 target_cwnd;
u32 rtt;
/* We have enough rtt samples, so, using the Veno /* We have enough rtt samples, so, using the Veno
* algorithm, we determine the state of the network. * algorithm, we determine the state of the network.
@ -141,8 +142,9 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
rtt = veno->minrtt; rtt = veno->minrtt;
target_cwnd = ((tp->snd_cwnd * veno->basertt) target_cwnd = (tp->snd_cwnd * veno->basertt);
<< V_PARAM_SHIFT) / rtt; target_cwnd <<= V_PARAM_SHIFT;
do_div(target_cwnd, rtt);
veno->diff = (tp->snd_cwnd << V_PARAM_SHIFT) - target_cwnd; veno->diff = (tp->snd_cwnd << V_PARAM_SHIFT) - target_cwnd;