tcp: address problems caused by EDT misshaps

When a qdisc setup including pacing FQ is dismantled and recreated,
some TCP packets are sent earlier than instructed by TCP stack.

TCP can be fooled when ACK comes back, because the following
operation can return a negative value.

    tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;

Some paths in TCP stack were not dealing properly with this,
this patch addresses four of them.

Fixes: ab408b6dc744 ("tcp: switch tcp and sch_fq to new earliest departure time model")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 4 deletions

diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 5f8b6d3cd855..091c53925e4d 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -40,15 +40,17 @@ static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         u32 elapsed, start_ts;
+        s32 remaining;
 
         start_ts = tcp_retransmit_stamp(sk);
         if (!icsk->icsk_user_timeout || !start_ts)
                 return icsk->icsk_rto;
         elapsed = tcp_time_stamp(tcp_sk(sk)) - start_ts;
-        if (elapsed >= icsk->icsk_user_timeout)
+        remaining = icsk->icsk_user_timeout - elapsed;
+        if (remaining <= 0)
                 return 1; /* user timeout has passed; fire ASAP */
-        else
-                return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(icsk->icsk_user_timeout - elapsed));
+
+        return min_t(u32, icsk->icsk_rto, msecs_to_jiffies(remaining));
 }
 
 /**
@@ -209,7 +211,7 @@ static bool retransmits_timed_out(struct sock *sk,
                                 (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
                 timeout = jiffies_to_msecs(timeout);
         }
-        return (tcp_time_stamp(tcp_sk(sk)) - start_ts) >= timeout;
+        return (s32)(tcp_time_stamp(tcp_sk(sk)) - start_ts - timeout) >= 0;
 }
 
 /* A write timeout has occurred. Process the after effects. */