tcp: Overflow bug in Vegas

From: Lachlan Andrew <lachlan.andrew@gmail.com>

There is an overflow bug in net/ipv4/tcp_vegas.c for large BDPs
(e.g. 400Mbit/s, 400ms).  The multiplication (old_wnd *
vegas->baseRTT) << V_PARAM_SHIFT overflows a u32.

[ Fix tcp_veno.c too, it has similar calculations. -DaveM ]

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 3 deletions

diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
index d16689e98516..2bf618a3b00b 100644
--- a/net/ipv4/tcp_veno.c
+++ b/net/ipv4/tcp_veno.c
@@ -133,7 +133,8 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                  */
                 tcp_reno_cong_avoid(sk, ack, in_flight);
         } else {
-                u32 rtt, target_cwnd;
+                u64 target_cwnd;
+                u32 rtt;
 
                 /* We have enough rtt samples, so, using the Veno
                  * algorithm, we determine the state of the network.
@@ -141,8 +142,9 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 
                 rtt = veno->minrtt;
 
-                target_cwnd = ((tp->snd_cwnd * veno->basertt)
-                               << V_PARAM_SHIFT) / rtt;
+                target_cwnd = (tp->snd_cwnd * veno->basertt);
+                target_cwnd <<= V_PARAM_SHIFT;
+                do_div(target_cwnd, rtt);
 
                 veno->diff = (tp->snd_cwnd << V_PARAM_SHIFT) - target_cwnd;