2 files changed, 13 insertions, 1 deletions

diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 7618d51aa2d2..122a716eb877 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -456,8 +456,9 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                   r_sample, t_elapsed);
                 else
                         r_sample -= t_elapsed;
+                CCID3_RTT_SANITY_CHECK(r_sample);
 
-                /* Update RTT estimate by 
+                /* Update RTT estimate by
                  * If (No feedback recv)
                  *    R = R_sample;
                  * Else
@@ -1000,6 +1001,7 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                   r_sample, t_elapsed);
                 else
                         r_sample -= t_elapsed;
+                CCID3_RTT_SANITY_CHECK(r_sample);
 
                 if (hcrx->ccid3hcrx_state == TFRC_RSTATE_NO_DATA)
                         hcrx->ccid3hcrx_rtt = r_sample;
diff --git a/net/dccp/ccids/ccid3.h b/net/dccp/ccids/ccid3.h
index da0ca3c0a7b3..3fa0f69ed320 100644
--- a/net/dccp/ccids/ccid3.h
+++ b/net/dccp/ccids/ccid3.h
@@ -51,6 +51,16 @@
 /* Parameter t_mbi from [RFC 3448, 4.3]: backoff interval in seconds */
 #define TFRC_T_MBI                 64
 
+/* What we think is a reasonable upper limit on RTT values */
+#define CCID3_SANE_RTT_MAX         (4 * USEC_PER_SEC)
+
+#define CCID3_RTT_SANITY_CHECK(rtt)                     do {               \
+                if (rtt > CCID3_SANE_RTT_MAX) {                            \
+                        DCCP_CRIT("RTT (%ld) too large, substituting %ld", \
+                                  rtt, CCID3_SANE_RTT_MAX);                \
+                        rtt = CCID3_SANE_RTT_MAX;                          \
+                }                                       } while (0)
+
 enum ccid3_options {
         TFRC_OPT_LOSS_EVENT_RATE = 192,
         TFRC_OPT_LOSS_INTERVALS  = 193,