tcp: avoid possible arithmetic overflows

icsk_rto is a 32bit field, and icsk_backoff can reach 15 by default,
or more if some sysctl (eg tcp_retries2) are changed.

Better use 64bit to perform icsk_rto << icsk_backoff operations

As Joe Perches suggested, add a helper for this.

Yuchung spotted the tcp_v4_err() case.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 2 deletions

diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index a339e7ba05a4..b24360f6e293 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -180,7 +180,7 @@ static int tcp_write_timeout(struct sock *sk)
 
                 retry_until = sysctl_tcp_retries2;
                 if (sock_flag(sk, SOCK_DEAD)) {
-                        const int alive = (icsk->icsk_rto < TCP_RTO_MAX);
+                        const int alive = icsk->icsk_rto < TCP_RTO_MAX;
 
                         retry_until = tcp_orphan_retries(sk, alive);
                         do_reset = alive ||
@@ -294,7 +294,7 @@ static void tcp_probe_timer(struct sock *sk)
         max_probes = sysctl_tcp_retries2;
 
         if (sock_flag(sk, SOCK_DEAD)) {
-                const int alive = ((icsk->icsk_rto << icsk->icsk_backoff) < TCP_RTO_MAX);
+                const int alive = inet_csk_rto_backoff(icsk, TCP_RTO_MAX) < TCP_RTO_MAX;
 
                 max_probes = tcp_orphan_retries(sk, alive);