Alexey Kodanev 64d9b03d08 dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart() ... [ Upstream commit 61ef4b07fc ] The shift of 'cwnd' with '(now - hc->tx_lsndtime) / hc->tx_rto' value can lead to undefined behavior [1]. In order to fix this use a gradual shift of the window with a 'while' loop, similar to what tcp_cwnd_restart() is doing. When comparing delta and RTO there is a minor difference between TCP and DCCP, the last one also invokes dccp_cwnd_restart() and reduces 'cwnd' if delta equals RTO. That case is preserved in this change. [1]: [40850.963623] UBSAN: Undefined behaviour in net/dccp/ccids/ccid2.c:237:7 [40851.043858] shift exponent 67 is too large for 32-bit type 'unsigned int' [40851.127163] CPU: 3 PID: 15940 Comm: netstress Tainted: G W E 4.18.0-rc7.x86_64 #1 ... [40851.377176] Call Trace: [40851.408503] dump_stack+0xf1/0x17b [40851.451331] ? show_regs_print_info+0x5/0x5 [40851.503555] ubsan_epilogue+0x9/0x7c [40851.548363] __ubsan_handle_shift_out_of_bounds+0x25b/0x2b4 [40851.617109] ? __ubsan_handle_load_invalid_value+0x18f/0x18f [40851.686796] ? xfrm4_output_finish+0x80/0x80 [40851.739827] ? lock_downgrade+0x6d0/0x6d0 [40851.789744] ? xfrm4_prepare_output+0x160/0x160 [40851.845912] ? ip_queue_xmit+0x810/0x1db0 [40851.895845] ? ccid2_hc_tx_packet_sent+0xd36/0x10a0 [dccp] [40851.963530] ccid2_hc_tx_packet_sent+0xd36/0x10a0 [dccp] [40852.029063] dccp_xmit_packet+0x1d3/0x720 [dccp] [40852.086254] dccp_write_xmit+0x116/0x1d0 [dccp] [40852.142412] dccp_sendmsg+0x428/0xb20 [dccp] [40852.195454] ? inet_dccp_listen+0x200/0x200 [dccp] [40852.254833] ? sched_clock+0x5/0x10 [40852.298508] ? sched_clock+0x5/0x10 [40852.342194] ? inet_create+0xdf0/0xdf0 [40852.388988] sock_sendmsg+0xd9/0x160 ... Fixes: 113ced1f52 ("dccp ccid-2: Perform congestion-window validation") Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-08-22 07:46:08 +02:00
..
ccids	dccp: fix undefined behavior with 'cwnd' shift in ccid2_cwnd_restart()	2018-08-22 07:46:08 +02:00
ackvec.c	dccp: drop null test before destroy functions	2015-09-15 16:49:43 -07:00
ackvec.h
ccid.c	dccp: drop null test before destroy functions	2015-09-15 16:49:43 -07:00
ccid.h
dccp.h	net: snmp: kill STATS_BH macros	2016-04-27 22:48:25 -04:00
diag.c	sock_diag: specify info_size per inet protocol	2015-06-15 19:49:22 -07:00
feat.c	dccp: fix a memleak for dccp_feat_init err process	2017-07-27 00:01:05 -07:00
feat.h
input.c	dccp: make const array error_code static	2017-07-13 09:24:02 -07:00
ipv4.c	dccp: initialize ireq->ir_mark	2018-05-16 10:10:24 +02:00
ipv6.c	dccp: initialize ireq->ir_mark	2018-05-16 10:10:24 +02:00
ipv6.h
Kconfig
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
minisocks.c	tcp/dccp: block bh before arming time_wait timer	2017-12-17 15:07:57 +01:00
options.c	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
output.c	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
probe.c	Use 64-bit timekeeping	2015-11-01 17:01:16 -05:00
proto.c	dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()	2018-06-11 22:49:18 +02:00
qpolicy.c
sysctl.c
timer.c	dccp: fix tasklet usage	2018-05-19 10:20:23 +02:00