From: Soheil Hassas Yeganeh <[email protected]> Date: Mon, 15 May 2017 17:05:47 -0400
> From: Soheil Hassas Yeganeh <[email protected]> > > tcp_ack() can call tcp_fragment() which may dededuct the > value tp->fackets_out when MSS changes. When prior_fackets > is larger than tp->fackets_out, tcp_clean_rtx_queue() can > invoke tcp_update_reordering() with negative values. This > results in absurd tp->reodering values higher than > sysctl_tcp_max_reordering. > > Note that tcp_update_reordering indeeds sets tp->reordering > to min(sysctl_tcp_max_reordering, metric), but because > the comparison is signed, a negative metric always wins. > > Fixes: c7caf8d3ed7a ("[TCP]: Fix reord detection due to snd_una covered > holes") > Reported-by: Rebecca Isaacs <[email protected]> > Signed-off-by: Soheil Hassas Yeganeh <[email protected]> > Signed-off-by: Neal Cardwell <[email protected]> > Signed-off-by: Yuchung Cheng <[email protected]> > Signed-off-by: Eric Dumazet <[email protected]> Applied and queued up for -stable, thanks.
