Alexey Kodanev 61ef4b07fc dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart() ... The shift of 'cwnd' with '(now - hc->tx_lsndtime) / hc->tx_rto' value can lead to undefined behavior [1]. In order to fix this use a gradual shift of the window with a 'while' loop, similar to what tcp_cwnd_restart() is doing. When comparing delta and RTO there is a minor difference between TCP and DCCP, the last one also invokes dccp_cwnd_restart() and reduces 'cwnd' if delta equals RTO. That case is preserved in this change. [1]: [40850.963623] UBSAN: Undefined behaviour in net/dccp/ccids/ccid2.c:237:7 [40851.043858] shift exponent 67 is too large for 32-bit type 'unsigned int' [40851.127163] CPU: 3 PID: 15940 Comm: netstress Tainted: G W E 4.18.0-rc7.x86_64 #1 ... [40851.377176] Call Trace: [40851.408503] dump_stack+0xf1/0x17b [40851.451331] ? show_regs_print_info+0x5/0x5 [40851.503555] ubsan_epilogue+0x9/0x7c [40851.548363] __ubsan_handle_shift_out_of_bounds+0x25b/0x2b4 [40851.617109] ? __ubsan_handle_load_invalid_value+0x18f/0x18f [40851.686796] ? xfrm4_output_finish+0x80/0x80 [40851.739827] ? lock_downgrade+0x6d0/0x6d0 [40851.789744] ? xfrm4_prepare_output+0x160/0x160 [40851.845912] ? ip_queue_xmit+0x810/0x1db0 [40851.895845] ? ccid2_hc_tx_packet_sent+0xd36/0x10a0 [dccp] [40851.963530] ccid2_hc_tx_packet_sent+0xd36/0x10a0 [dccp] [40852.029063] dccp_xmit_packet+0x1d3/0x720 [dccp] [40852.086254] dccp_write_xmit+0x116/0x1d0 [dccp] [40852.142412] dccp_sendmsg+0x428/0xb20 [dccp] [40852.195454] ? inet_dccp_listen+0x200/0x200 [dccp] [40852.254833] ? sched_clock+0x5/0x10 [40852.298508] ? sched_clock+0x5/0x10 [40852.342194] ? inet_create+0xdf0/0xdf0 [40852.388988] sock_sendmsg+0xd9/0x160 ... Fixes: 113ced1f52 ("dccp ccid-2: Perform congestion-window validation") Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-08-07 15:34:44 -07:00
..
ccids	dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()	2018-08-07 15:34:44 -07:00
ackvec.c	net: dccp: drop unneeded newline	2018-01-02 13:49:32 -05:00
ackvec.h	net: dccp: Remove extern from function prototypes	2013-10-19 19:12:11 -04:00
ccid.c	dccp: drop null test before destroy functions	2015-09-15 16:49:43 -07:00
ccid.h	net: dccp: Remove extern from function prototypes	2013-10-19 19:12:11 -04:00
dccp.h	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
diag.c	sock_diag: specify info_size per inet protocol	2015-06-15 19:49:22 -07:00
feat.c	dccp: fix a memleak for dccp_feat_init err process	2017-07-27 00:01:05 -07:00
feat.h	net: dccp: Remove extern from function prototypes	2013-10-19 19:12:11 -04:00
input.c	net: dccp: mark expected switch fall-throughs	2017-10-16 21:15:21 +01:00
ipv4.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
ipv6.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
ipv6.h	inet: includes a sock_common in request_sock	2013-10-10 00:08:07 -04:00
Kconfig	net: dccp: Remove dccpprobe module	2018-01-02 14:27:30 -05:00
Makefile	net: dccp: Remove dccpprobe module	2018-01-02 14:27:30 -05:00
minisocks.c	net-tcp: remove useless tw_timeout field	2018-06-05 10:45:24 -04:00
options.c	net: dccp: mark expected switch fall-throughs	2017-10-16 21:15:21 +01:00
output.c	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
proto.c	Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL	2018-06-28 10:40:47 -07:00
qpolicy.c	dccp qpolicy: Parameter checking of cmsg qpolicy parameters	2010-12-07 13:47:12 +01:00
sysctl.c	dccp: make the request_retries minimum is 1	2014-05-14 15:34:16 -04:00
timer.c	dccp: fix tasklet usage	2018-05-03 15:14:57 -04:00
trace.h	net: dccp: Add DCCP sendmsg trace event	2018-01-02 14:27:30 -05:00