From: Jesper Dangaard Brouer <brouer@redhat•com>
To: "David S. Miller" <davem@davemloft•net>
Cc: Jesper Dangaard Brouer <brouer@redhat•com>,
netdev@vger•kernel.org, Petr Matousek <pmatouse@redhat•com>,
Stephen Hemminger <shemminger@vyatta•com>
Subject: [PATCH net] net: fix divide by zero in tcp algorithm illinois
Date: Wed, 31 Oct 2012 11:37:08 +0100 [thread overview]
Message-ID: <20121031103630.18756.15685.stgit@dragon> (raw)
Reading TCP stats when using TCP Illinois congestion control algorithm
can cause a divide by zero kernel oops.
The division by zero occur in tcp_illinois_info() at:
do_div(t, ca->cnt_rtt);
where ca->cnt_rtt can become zero (when rtt_reset is called)
Steps to Reproduce:
1. Register tcp_illinois:
# sysctl -w net.ipv4.tcp_congestion_control=illinois
2. Monitor internal TCP information via command "ss -i"
# watch -d ss -i
3. Establish new TCP conn to machine
Either it fails at the initial conn, or else it needs to wait
for a loss or a reset.
This is only related to reading stats. The function avg_delay() also
performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
calling point in update_params(). Thus, simply fix tcp_illinois_info().
To be on the safe side, I use a local stack variable in tcp_illinois_info()
to eliminate any race conditions. I'm not sure this is needed, as this
would also affect avg_delay(), if this race exists. (Although this is likely
already "fix" by compiler optimization and kept in a local register)
Cc: Petr Matousek <pmatouse@redhat•com>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat•com>
---
net/ipv4/tcp_illinois.c | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 813b43a..343f160 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -306,6 +306,7 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
struct sk_buff *skb)
{
const struct illinois *ca = inet_csk_ca(sk);
+ u16 cnt_rtt;
if (ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
struct tcpvegas_info info = {
@@ -315,8 +316,11 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
};
u64 t = ca->sum_rtt;
- do_div(t, ca->cnt_rtt);
- info.tcpv_rtt = t;
+ cnt_rtt = ca->cnt_rtt;
+ if (cnt_rtt > 0) {
+ do_div(t, cnt_rtt);
+ info.tcpv_rtt = t;
+ }
nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
}
next reply other threads:[~2012-10-31 10:36 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-31 10:37 Jesper Dangaard Brouer [this message]
2012-10-31 11:17 ` [PATCH net] net: fix divide by zero in tcp algorithm illinois Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121031103630.18756.15685.stgit@dragon \
--to=brouer@redhat$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pmatouse@redhat$(echo .)com \
--cc=shemminger@vyatta$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox