Commit b451e5d2 authored May 10, 2017 by Yuchung Cheng Committed by David S. Miller May 11, 2017

tcp: avoid fragmenting peculiar skbs in SACK



This patch fixes a bug in splitting an SKB during SACK
processing. Specifically if an skb contains multiple
packets and is only partially sacked in the higher sequences,
tcp_match_sack_to_skb() splits the skb and marks the second fragment
as SACKed.

The current code further attempts rounding up the first fragment
to MSS boundaries. But it misses a boundary condition when the
rounded-up fragment size (pkt_len) is exactly skb size.  Spliting
such an skb is pointless and causses a kernel warning and aborts
the SACK processing. This patch universally checks such over-split
before calling tcp_fragment to prevent these unnecessary warnings.

Fixes: adb92db8 ("tcp: Make SACK code to split only at mss boundaries")
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f6ba8d33

net/ipv4/tcp_input.c

+5 −4

Original line number	Diff line number	Diff line
		@@ -1179,13 +1179,14 @@ static int tcp_match_skb_to_sack(struct sock sk, struct sk_buff skb,
		*/
		if (pkt_len > mss) {
		unsigned int new_len = (pkt_len / mss) * mss;
		if (!in_sack && new_len < pkt_len) {
		if (!in_sack && new_len < pkt_len)
		new_len += mss;
		if (new_len >= skb->len)
		return 0;
		}
		pkt_len = new_len;
		}

		if (pkt_len >= skb->len && !in_sack)
		return 0;

		err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
		if (err < 0)
		return err;

Admin message