From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:53452 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751236AbdEaAQ6 (ORCPT ); Tue, 30 May 2017 20:16:58 -0400 Subject: Patch "tcp: eliminate negative reordering in tcp_clean_rtx_queue" has been added to the 4.11-stable tree To: soheil@google.com, davem@davemloft.net, edumazet@google.com, gregkh@linuxfoundation.org, ncardwell@google.com, risaacs@google.com, ycheng@google.com Cc: , From: Date: Wed, 31 May 2017 09:14:30 +0900 Message-ID: <14961896707159@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled tcp: eliminate negative reordering in tcp_clean_rtx_queue to the 4.11-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tcp-eliminate-negative-reordering-in-tcp_clean_rtx_queue.patch and it can be found in the queue-4.11 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Wed May 31 09:13:10 JST 2017 From: Soheil Hassas Yeganeh Date: Mon, 15 May 2017 17:05:47 -0400 Subject: tcp: eliminate negative reordering in tcp_clean_rtx_queue From: Soheil Hassas Yeganeh [ Upstream commit bafbb9c73241760023d8981191ddd30bb1c6dbac ] tcp_ack() can call tcp_fragment() which may dededuct the value tp->fackets_out when MSS changes. When prior_fackets is larger than tp->fackets_out, tcp_clean_rtx_queue() can invoke tcp_update_reordering() with negative values. This results in absurd tp->reodering values higher than sysctl_tcp_max_reordering. Note that tcp_update_reordering indeeds sets tp->reordering to min(sysctl_tcp_max_reordering, metric), but because the comparison is signed, a negative metric always wins. Fixes: c7caf8d3ed7a ("[TCP]: Fix reord detection due to snd_una covered holes") Reported-by: Rebecca Isaacs Signed-off-by: Soheil Hassas Yeganeh Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3189,7 +3189,7 @@ static int tcp_clean_rtx_queue(struct so int delta; /* Non-retransmitted hole got filled? That's reordering */ - if (reord < prior_fackets) + if (reord < prior_fackets && reord <= tp->fackets_out) tcp_update_reordering(sk, tp->fackets_out - reord, 0); delta = tcp_is_fack(tp) ? pkts_acked : Patches currently in stable-queue which might be from soheil@google.com are queue-4.11/tcp-eliminate-negative-reordering-in-tcp_clean_rtx_queue.patch queue-4.11/net-packet-fix-missing-net_device-reference-release.patch queue-4.11/tcp-avoid-fragmenting-peculiar-skbs-in-sack.patch