Author: jtl
Date: Fri May 6 01:27:01 2016
New Revision: 299147
URL: https://svnweb.freebsd.org/changeset/base/299147
Log:
MFC r298408:
Prevent underflows in tp->snd_wnd if the remote side ACKs more than
tp->snd_wnd. This can happen, for example, when the remote side responds
to a window probe by ACKing the one byte it contains.
Modified:
stable/9/sys/netinet/tcp_input.c
Directory Properties:
stable/9/sys/ (props changed)
Modified: stable/9/sys/netinet/tcp_input.c
==============================================================================
--- stable/9/sys/netinet/tcp_input.c Fri May 6 01:26:58 2016
(r299146)
+++ stable/9/sys/netinet/tcp_input.c Fri May 6 01:27:01 2016
(r299147)
@@ -2629,6 +2629,9 @@ process_ACK:
INP_WLOCK_ASSERT(tp->t_inpcb);
acked = BYTES_THIS_ACK(tp, th);
+ KASSERT(acked >= 0, ("%s: acked unexepectedly negative "
+ "(tp->snd_una=%u, th->th_ack=%u, tp=%p, m=%p)", __func__,
+ tp->snd_una, th->th_ack, tp, m));
TCPSTAT_INC(tcps_rcvackpack);
TCPSTAT_ADD(tcps_rcvackbyte, acked);
@@ -2698,12 +2701,18 @@ process_ACK:
SOCKBUF_LOCK(&so->so_snd);
if (acked > so->so_snd.sb_cc) {
- tp->snd_wnd -= so->so_snd.sb_cc;
+ if (tp->snd_wnd >= so->so_snd.sb_cc)
+ tp->snd_wnd -= so->so_snd.sb_cc;
+ else
+ tp->snd_wnd = 0;
sbdrop_locked(&so->so_snd, (int)so->so_snd.sb_cc);
ourfinisacked = 1;
} else {
sbdrop_locked(&so->so_snd, acked);
- tp->snd_wnd -= acked;
+ if (tp->snd_wnd >= (u_long) acked)
+ tp->snd_wnd -= acked;
+ else
+ tp->snd_wnd = 0;
ourfinisacked = 0;
}
/* NB: sowwakeup_locked() does an implicit unlock. */
_______________________________________________
svn-src-stable-9@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-9
To unsubscribe, send any mail to "svn-src-stable-9-unsubscr...@freebsd.org"
