tcp: avoid possible arithmetic overflows

icsk_rto is a 32bit field, and icsk_backoff can reach 15 by default,
or more if some sysctl (eg tcp_retries2) are changed.

Better use 64bit to perform icsk_rto << icsk_backoff operations

As Joe Perches suggested, add a helper for this.

Yuchung spotted the tcp_v4_err() case.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 2 deletions

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 02fb66d4a018..13f3da4762e3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3208,9 +3208,10 @@ static void tcp_ack_probe(struct sock *sk)
                  * This function is not for random using!
                  */
         } else {
+                unsigned long when = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);
+
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
-                                          min(icsk->icsk_rto << icsk->icsk_backoff, TCP_RTO_MAX),
-                                          TCP_RTO_MAX);
+                                          when, TCP_RTO_MAX);
         }
 }