aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorIlpo Järvinen <ilpo.jarvinen@helsinki.fi>2007-11-14 00:03:13 -0500
committerDavid S. Miller <davem@davemloft.net>2007-11-14 00:03:13 -0500
commit23aeeec365dcf8bc87fae44c533e50d0bb4f23cc (patch)
treed4cbe2045d0e5c27492d184d77c2c2ed04995a75 /net
parent746aa32d280084dbd520249170852e4616799928 (diff)
[TCP] FRTO: Plug potential LOST-bit leak
It might be possible that, in some extreme scenario that I just cannot now construct in my mind, end_seq <= frto_highmark check does not match causing the lost_out and LOST bits become out-of-sync due to clearing and recounting in the loop. This may fix LOST-bit leak reported by Chazarain Guillaume <guichaz@yahoo.fr>. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/ipv4/tcp_input.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b59da5308ac0..12ae9a68cdaa 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1704,6 +1704,8 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
1704 tcp_for_write_queue(skb, sk) { 1704 tcp_for_write_queue(skb, sk) {
1705 if (skb == tcp_send_head(sk)) 1705 if (skb == tcp_send_head(sk))
1706 break; 1706 break;
1707
1708 TCP_SKB_CB(skb)->sacked &= ~TCPCB_LOST;
1707 /* 1709 /*
1708 * Count the retransmission made on RTO correctly (only when 1710 * Count the retransmission made on RTO correctly (only when
1709 * waiting for the first ACK and did not get it)... 1711 * waiting for the first ACK and did not get it)...
@@ -1717,7 +1719,7 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
1717 } else { 1719 } else {
1718 if (TCP_SKB_CB(skb)->sacked & TCPCB_RETRANS) 1720 if (TCP_SKB_CB(skb)->sacked & TCPCB_RETRANS)
1719 tp->undo_marker = 0; 1721 tp->undo_marker = 0;
1720 TCP_SKB_CB(skb)->sacked &= ~(TCPCB_LOST|TCPCB_SACKED_RETRANS); 1722 TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
1721 } 1723 }
1722 1724
1723 /* Don't lost mark skbs that were fwd transmitted after RTO */ 1725 /* Don't lost mark skbs that were fwd transmitted after RTO */