Page MenuHomeFreeBSD
Files F177552253

D58323.1794698422.diff
No OneTemporary
Actions

Authored By
Unknown
Size
4 KB
Referenced Files
None
Subscribers
None

D58323.1794698422.diff
View Options

diff --git a/sys/dev/irdma/irdma_cm.c b/sys/dev/irdma/irdma_cm.c
--- a/sys/dev/irdma/irdma_cm.c
+++ b/sys/dev/irdma/irdma_cm.c
@@ -822,13 +822,20 @@
*/
static int
irdma_process_options(struct irdma_cm_node *cm_node, u8 *optionsloc,
- u32 optionsize, u32 syn_pkt)
+ int optionsize, u32 syn_pkt)
{
u32 tmp;
- u32 offset = 0;
+ int offset = 0;
union all_known_options *all_options;
char got_mss_option = 0;
+ if ((optionsize < 0) || (optionsize > MAX_TCPOPTLEN)) {
+ irdma_debug(&cm_node->iwdev->rf->sc_dev, IRDMA_DEBUG_CM,
+ "Option Size: %d out of bound\n",
+ optionsize);
+ /* return silently */
+ return 0;
+ }
while (offset < optionsize) {
all_options = (union all_known_options *)(optionsloc + offset);
switch (all_options->base.optionnum) {
@@ -2668,7 +2675,11 @@
u32 inc_sequence;
int optionsize;
+ if (tcph->th_off < 5) {
+ return;
+ }
optionsize = (tcph->th_off << 2) - sizeof(*tcph);
+
inc_sequence = ntohl(tcph->th_seq);
switch (cm_node->state) {
@@ -2736,7 +2747,11 @@
u32 inc_sequence;
int optionsize;
+ if (tcph->th_off < 5) {
+ return;
+ }
optionsize = (tcph->th_off << 2) - sizeof(*tcph);
+
inc_sequence = ntohl(tcph->th_seq);
switch (cm_node->state) {
case IRDMA_CM_STATE_SYN_SENT:
@@ -2811,6 +2826,9 @@
int optionsize;
u32 datasize = rbuf->datalen;
+ if (tcph->th_off < 5) {
+ return -EINVAL;
+ }
optionsize = (tcph->th_off << 2) - sizeof(*tcph);
if (irdma_check_seq(cm_node, tcph))
diff --git a/sys/dev/irdma/irdma_utils.c b/sys/dev/irdma/irdma_utils.c
--- a/sys/dev/irdma/irdma_utils.c
+++ b/sys/dev/irdma/irdma_utils.c
@@ -1541,6 +1541,13 @@
}
buf->tcphlen = tcph->th_off << 2;
+ if (buf->tcphlen < 20) {
+ irdma_debug(buf->vsi->dev, IRDMA_DEBUG_ERR,
+ "tcp hlen too small 0x%x\n",
+ buf->tcphlen);
+ return -EINVAL;
+ }
+
buf->datalen = pkt_len - iphlen - buf->tcphlen;
buf->data = buf->datalen ? buf->tcph + buf->tcphlen : NULL;
buf->hdrlen = buf->maclen + iphlen + buf->tcphlen;
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -496,6 +496,7 @@
tp->sackhint.delivered_data = 0;
tp->sackhint.prr_delivered = 0;
tp->sackhint.prr_out = 0;
+ tp->snd_cwnd = tp->snd_ssthresh;
}
/*
@@ -1496,6 +1497,7 @@
struct tcpopt to;
int tfo_syn;
u_int maxseg = 0;
+ uint32_t prev_sacked_bytes = 0;
bool no_data;
no_data = (tlen == 0);
@@ -2515,6 +2517,7 @@
goto dropafterack;
}
if (tcp_is_sack_recovery(tp, &to)) {
+ prev_sacked_bytes = tp->sackhint.sacked_bytes;
sack_changed = tcp_sack_doack(tp, &to, th->th_ack);
if ((sack_changed != SACK_NOCHANGE) &&
(tp->t_flags & TF_LRD)) {
@@ -2666,12 +2669,15 @@
tp->sackhint.prr_delivered =
imin(tp->snd_max - th->th_ack,
(tp->snd_limited + 1) * maxseg);
+ tp->sackhint.recover_fs = imax(1,
+ (tp->snd_nxt - tp->snd_una) - prev_sacked_bytes
+ + tp->sackhint.delivered_data);
} else {
tp->sackhint.prr_delivered =
maxseg;
+ tp->sackhint.recover_fs = max(1,
+ tp->snd_nxt - tp->snd_una);
}
- tp->sackhint.recover_fs = max(1,
- tp->snd_nxt - tp->snd_una);
}
tp->snd_limited = 0;
if (tcp_is_sack_recovery(tp, &to)) {
@@ -3994,8 +4000,9 @@
tcp_do_prr_ack(struct tcpcb *tp, struct tcphdr *th, struct tcpopt *to,
sackstatus_t sack_changed, u_int *maxsegp)
{
- int snd_cnt = 0, limit = 0, del_data = 0, pipe = 0;
+ int snd_cnt = 0, del_data = 0, pipe = 0;
u_int maxseg;
+ bool safe_ack;
INP_WLOCK_ASSERT(tptoinpcb(tp));
@@ -4021,6 +4028,10 @@
pipe = imax(0, tp->snd_max - tp->snd_una -
imin(INT_MAX / 65536, tp->t_dupacks) * maxseg);
}
+
+ if (del_data == 0)
+ return;
+
tp->sackhint.prr_delivered += del_data;
/*
* Proportional Rate Reduction
@@ -4033,25 +4044,16 @@
tp->snd_ssthresh, tp->sackhint.recover_fs) -
tp->sackhint.prr_out + maxseg - 1;
} else {
- /*
- * PRR 6937bis heuristic:
- * - A partial ack without SACK block beneath snd_recover
- * indicates further loss.
- * - An SACK scoreboard update adding a new hole indicates
- * further loss, so be conservative and send at most one
- * segment.
- * - Prevent ACK splitting attacks, by being conservative
- * when no new data is acked.
- */
- if ((sack_changed == SACK_NEWLOSS) || (del_data == 0)) {
- limit = tp->sackhint.prr_delivered -
- tp->sackhint.prr_out;
- } else {
- limit = imax(tp->sackhint.prr_delivered -
- tp->sackhint.prr_out, del_data) +
- maxseg;
+ safe_ack = SEQ_GT(th->th_ack, tp->snd_una) && (sack_changed != SACK_NEWLOSS);
+ snd_cnt = imax(tp->sackhint.prr_delivered - tp->sackhint.prr_out, del_data);
+ if (safe_ack) {
+ snd_cnt += maxseg;
}
- snd_cnt = imin((tp->snd_ssthresh - pipe), limit);
+ snd_cnt = imin(tp->snd_ssthresh - pipe, snd_cnt);
+ }
+
+ if (tp->sackhint.prr_out == 0 && snd_cnt == 0) {
+ snd_cnt = maxseg;
}
snd_cnt = imax(snd_cnt, 0) / maxseg;
/*

File Metadata

Mime Type
text/plain
Expires
Sat, Nov 14, 11:20 PM (18 h, 39 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41733757
Default Alt Text
D58323.1794698422.diff (4 KB)

Event Timeline