Commit 882bebaa authored by Ilpo Järvinen's avatar Ilpo Järvinen Committed by David S. Miller

[TCP]: tcp_simple_retransmit can cause S+L

This fixes Bugzilla #10384

tcp_simple_retransmit does L increment without any checking
whatsoever for overflowing S+L when Reno is in use.

The simplest scenario I can currently think of is rather
complex in practice (there might be some more straightforward
cases though). Ie., if mss is reduced during mtu probing, it
may end up marking everything lost and if some duplicate ACKs
arrived prior to that sacked_out will be non-zero as well,
leading to S+L > packets_out, tcp_clean_rtx_queue on the next
cumulative ACK or tcp_fastretrans_alert on the next duplicate
ACK will fix the S counter.

More straightforward (but questionable) solution would be to
just call tcp_reset_reno_sack() in tcp_simple_retransmit but
it would negatively impact the probe's retransmission, ie.,
the retransmissions would not occur if some duplicate ACKs
had arrived.

So I had to add reno sacked_out reseting to CA_Loss state
when the first cumulative ACK arrives (this stale sacked_out
might actually be the explanation for the reports of left_out
overflows in kernel prior to 2.6.23 and S+L overflow reports
of 2.6.24). However, this alone won't be enough to fix kernel
before 2.6.24 because it is building on top of the commit
1b6d427b ([TCP]: Reduce sacked_out with reno when purging
write_queue) to keep the sacked_out from overflowing.
Signed-off-by: default avatarIlpo Järvinen <ilpo.jarvinen@helsinki.fi>
Reported-by: default avatarAlessandro Suardi <alessandro.suardi@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c137f3dd
...@@ -752,6 +752,8 @@ static inline unsigned int tcp_packets_in_flight(const struct tcp_sock *tp) ...@@ -752,6 +752,8 @@ static inline unsigned int tcp_packets_in_flight(const struct tcp_sock *tp)
return tp->packets_out - tcp_left_out(tp) + tp->retrans_out; return tp->packets_out - tcp_left_out(tp) + tp->retrans_out;
} }
extern int tcp_limit_reno_sacked(struct tcp_sock *tp);
/* If cwnd > ssthresh, we may raise ssthresh to be half-way to cwnd. /* If cwnd > ssthresh, we may raise ssthresh to be half-way to cwnd.
* The exception is rate halving phase, when cwnd is decreasing towards * The exception is rate halving phase, when cwnd is decreasing towards
* ssthresh. * ssthresh.
......
...@@ -1625,13 +1625,11 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, ...@@ -1625,13 +1625,11 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb,
return flag; return flag;
} }
/* If we receive more dupacks than we expected counting segments /* Limits sacked_out so that sum with lost_out isn't ever larger than
* in assumption of absent reordering, interpret this as reordering. * packets_out. Returns zero if sacked_out adjustement wasn't necessary.
* The only another reason could be bug in receiver TCP.
*/ */
static void tcp_check_reno_reordering(struct sock *sk, const int addend) int tcp_limit_reno_sacked(struct tcp_sock *tp)
{ {
struct tcp_sock *tp = tcp_sk(sk);
u32 holes; u32 holes;
holes = max(tp->lost_out, 1U); holes = max(tp->lost_out, 1U);
...@@ -1639,8 +1637,20 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend) ...@@ -1639,8 +1637,20 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend)
if ((tp->sacked_out + holes) > tp->packets_out) { if ((tp->sacked_out + holes) > tp->packets_out) {
tp->sacked_out = tp->packets_out - holes; tp->sacked_out = tp->packets_out - holes;
tcp_update_reordering(sk, tp->packets_out + addend, 0); return 1;
} }
return 0;
}
/* If we receive more dupacks than we expected counting segments
* in assumption of absent reordering, interpret this as reordering.
* The only another reason could be bug in receiver TCP.
*/
static void tcp_check_reno_reordering(struct sock *sk, const int addend)
{
struct tcp_sock *tp = tcp_sk(sk);
if (tcp_limit_reno_sacked(tp))
tcp_update_reordering(sk, tp->packets_out + addend, 0);
} }
/* Emulate SACKs for SACKless connection: account for a new dupack. */ /* Emulate SACKs for SACKless connection: account for a new dupack. */
...@@ -2600,6 +2610,8 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag) ...@@ -2600,6 +2610,8 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
case TCP_CA_Loss: case TCP_CA_Loss:
if (flag & FLAG_DATA_ACKED) if (flag & FLAG_DATA_ACKED)
icsk->icsk_retransmits = 0; icsk->icsk_retransmits = 0;
if (tcp_is_reno(tp) && flag & FLAG_SND_UNA_ADVANCED)
tcp_reset_reno_sack(tp);
if (!tcp_try_undo_loss(sk)) { if (!tcp_try_undo_loss(sk)) {
tcp_moderate_cwnd(tp); tcp_moderate_cwnd(tp);
tcp_xmit_retransmit_queue(sk); tcp_xmit_retransmit_queue(sk);
......
...@@ -1808,6 +1808,9 @@ void tcp_simple_retransmit(struct sock *sk) ...@@ -1808,6 +1808,9 @@ void tcp_simple_retransmit(struct sock *sk)
if (!lost) if (!lost)
return; return;
if (tcp_is_reno(tp))
tcp_limit_reno_sacked(tp);
tcp_verify_left_out(tp); tcp_verify_left_out(tp);
/* Don't muck with the congestion window here. /* Don't muck with the congestion window here.
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment