Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5105d461 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

tcp: fix cookie_init_timestamp() overflows 



[ Upstream commit 73ed8e03388d16c12fc577e5c700b58a29045a15 ]

cookie_init_timestamp() is supposed to return a 64bit timestamp
suitable for both TSval determination and setting of skb->tstamp.

Unfortunately it uses 32bit fields and overflows after
2^32 * 10^6 nsec (~49 days) of uptime.

Generated TSval are still correct, but skb->tstamp might be set
far away in the past, potentially confusing other layers.

tcp_ns_to_ts() is changed to return a full 64bit value,
ts and ts_now variables are changed to u64 type,
and TSMASK is removed in favor of shifts operations.

While we are at it, change this sequence:
		ts >>= TSBITS;
		ts--;
		ts <<= TSBITS;
		ts |= options;
to:
		ts -= (1UL << TSBITS);

Fixes: 9a568de4 ("tcp: switch TCP TS option (RFC 7323) to 1ms clock")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e4e819bd

include/net/tcp.h

+1 −1
Original line number Diff line number Diff line
@@ -776,7 +776,7 @@ static inline u32 tcp_time_stamp(const struct tcp_sock *tp) 
}



/* Convert a nsec timestamp into TCP TSval timestamp (ms based currently) */

static inline u32 tcp_ns_to_ts(u64 ns)

static inline u64 tcp_ns_to_ts(u64 ns)

{

	return div_u64(ns, NSEC_PER_SEC / TCP_TS_HZ);

}

net/ipv4/syncookies.c

+7 −13
Original line number Diff line number Diff line
@@ -43,7 +43,6 @@ static siphash_key_t syncookie_secret[2] __read_mostly; 
 * requested/supported by the syn/synack exchange.

 */

#define TSBITS	6

#define TSMASK	(((__u32)1 << TSBITS) - 1)



static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,

		       u32 count, int c)
@@ -64,27 +63,22 @@ static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport, 
 */

u64 cookie_init_timestamp(struct request_sock *req, u64 now)

{

	struct inet_request_sock *ireq;

	u32 ts, ts_now = tcp_ns_to_ts(now);

	const struct inet_request_sock *ireq = inet_rsk(req);

	u64 ts, ts_now = tcp_ns_to_ts(now);

	u32 options = 0;



	ireq = inet_rsk(req);



	options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;

	if (ireq->sack_ok)

		options |= TS_OPT_SACK;

	if (ireq->ecn_ok)

		options |= TS_OPT_ECN;



	ts = ts_now & ~TSMASK;

	ts = (ts_now >> TSBITS) << TSBITS;

	ts |= options;

	if (ts > ts_now) {

		ts >>= TSBITS;

		ts--;

		ts <<= TSBITS;

		ts |= options;

	}

	return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);

	if (ts > ts_now)

		ts -= (1UL << TSBITS);



	return ts * (NSEC_PER_SEC / TCP_TS_HZ);

}