[DCCP] ccid3: Sanity-check RTT samples

CCID3 performance depends much on the accuracy of RTT samples.  If RTT
samples grow too large, performance can be catastrophically poor.

To limit the amount of possible damage in such cases, the patch
 * introduces an upper limit which identifies a maximum `sane' RTT value;
 * uses a macro to enforce this upper limit.

Using a macro was given preference, since it is necessary to identify the
calling function in the warning message. Since exceeding this threshold
identifies a critical condition, DCCP_CRIT is used and not DCCP_WARN.

Many thanks to Ian McDonald for collaboration on this issue.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 7618d51aa2d2..122a716eb877 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -456,8 +456,9 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                   r_sample, t_elapsed);
                 else
                         r_sample -= t_elapsed;
+                CCID3_RTT_SANITY_CHECK(r_sample);
 
-                /* Update RTT estimate by 
+                /* Update RTT estimate by
                  * If (No feedback recv)
                  *    R = R_sample;
                  * Else
@@ -1000,6 +1001,7 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                   r_sample, t_elapsed);
                 else
                         r_sample -= t_elapsed;
+                CCID3_RTT_SANITY_CHECK(r_sample);
 
                 if (hcrx->ccid3hcrx_state == TFRC_RSTATE_NO_DATA)
                         hcrx->ccid3hcrx_rtt = r_sample;