linux-yocto/net/ipv4
Neal Cardwell d54e0c077b tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
[ Upstream commit d0fa59897e ]

After the following commit from 2024:

commit e37ab73736 ("tcp: fix to allow timestamp undo if no retransmits were sent")

...there was buggy behavior where TCP connections without SACK support
could easily see erroneous undo events at the end of fast recovery or
RTO recovery episodes. The erroneous undo events could cause those
connections to suffer repeated loss recovery episodes and high
retransmit rates.

The problem was an interaction between the non-SACK behavior on these
connections and the undo logic. The problem is that, for non-SACK
connections at the end of a loss recovery episode, if snd_una ==
high_seq, then tcp_is_non_sack_preventing_reopen() holds steady in
CA_Recovery or CA_Loss, but clears tp->retrans_stamp to 0. Then upon
the next ACK the "tcp: fix to allow timestamp undo if no retransmits
were sent" logic saw the tp->retrans_stamp at 0 and erroneously
concluded that no data was retransmitted, and erroneously performed an
undo of the cwnd reduction, restoring cwnd immediately to the value it
had before loss recovery.  This caused an immediate burst of traffic
and build-up of queues and likely another immediate loss recovery
episode.

This commit fixes tcp_packet_delayed() to ignore zero retrans_stamp
values for non-SACK connections when snd_una is at or above high_seq,
because tcp_is_non_sack_preventing_reopen() clears retrans_stamp in
this case, so it's not a valid signal that we can undo.

Note that the commit named in the Fixes footer restored long-present
behavior from roughly 2005-2019, so apparently this bug was present
for a while during that era, and this was simply not caught.

Fixes: e37ab73736 ("tcp: fix to allow timestamp undo if no retransmits were sent")
Reported-by: Eric Wheeler <netdev@lists.ewheeler.net>
Closes: https://lore.kernel.org/netdev/64ea9333-e7f9-0df-b0f2-8d566143acab@ewheeler.net/
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Co-developed-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2025-06-27 11:05:36 +01:00
..
bpfilter
netfilter netfilter: fib: check correct rtable in vrf setups 2024-10-17 15:11:57 +02:00
af_inet.c net: inet: do not leave a dangling sk pointer in inet_create() 2024-12-14 19:51:37 +01:00
ah4.c
arp.c arp: switch to dev_getbyhwaddr() in arp_req_set_public() 2025-03-13 12:50:53 +01:00
bpf_tcp_ca.c
cipso_ipv4.c cipso: fix total option length computation 2024-07-05 09:14:29 +02:00
datagram.c
devinet.c ipv4: use RCU protection in inet_select_addr() 2025-03-13 12:50:42 +01:00
esp4_offload.c xfrm: Linearize the skb after offloading if needed. 2023-06-28 10:29:46 +02:00
esp4.c net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP 2024-08-19 05:44:55 +02:00
fib_frontend.c ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). 2025-06-04 14:37:59 +02:00
fib_lookup.h
fib_notifier.c
fib_rules.c ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). 2025-06-04 14:38:03 +02:00
fib_semantics.c net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
fib_trie.c ipv4: fib: Move fib_valid_key_len() to rtm_to_fib_config(). 2025-06-04 14:37:59 +02:00
fou.c fou: remove warn in gue_gro_receive on unsupported protocol 2024-12-14 19:51:46 +01:00
gre_demux.c
gre_offload.c gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
icmp.c icmp: prevent possible NULL dereferences from icmp_build_probe() 2024-05-02 16:24:44 +02:00
igmp.c bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument 2024-03-26 18:21:23 -04:00
inet_connection_sock.c tcp: Fix use-after-free of nreq in reqsk_timer_handler(). 2024-12-14 19:51:10 +01:00
inet_diag.c inet_diag: Initialize pad field in struct inet_diag_req_v2 2024-07-18 13:07:31 +02:00
inet_fragment.c inet: inet_defrag: prevent sk release while still in use 2024-10-17 15:10:41 +02:00
inet_hashtables.c tcp: bring back NUMA dispersion in inet_ehash_locks_alloc() 2025-06-04 14:37:58 +02:00
inet_timewait_sock.c tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() 2024-05-02 16:24:49 +02:00
inetpeer.c
ip_forward.c
ip_fragment.c inet: inet_defrag: prevent sk release while still in use 2024-10-17 15:10:41 +02:00
ip_gre.c net: Handle l3mdev in ip_tunnel_init_flow 2024-10-17 15:12:01 +02:00
ip_input.c ipv4: ignore dst hint for multipath routes 2023-09-19 12:22:58 +02:00
ip_options.c
ip_output.c net: ipv4: fix a memleak in ip_setup_cork 2024-02-23 08:54:54 +01:00
ip_sockglue.c bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument 2024-03-26 18:21:23 -04:00
ip_tunnel_core.c net: fix geneve_opt length integer overflow 2025-04-10 14:32:05 +02:00
ip_tunnel.c ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() 2025-02-01 18:24:01 +01:00
ip_vti.c ip_vti: fix potential slab-use-after-free in decode_session6 2023-08-26 14:23:32 +02:00
ipcomp.c
ipconfig.c
ipip.c
ipmr_base.c ipmr: do not call mr_mfc_uses_dev() for unres entries 2025-03-13 12:50:11 +01:00
ipmr.c ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function 2024-03-26 18:21:23 -04:00
Kconfig
Makefile
metrics.c ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() 2023-02-01 08:27:27 +01:00
netfilter.c
netlink.c
nexthop.c net: nexthop: Initialize all fields in dumped nexthops 2024-08-19 05:45:24 +02:00
ping.c
proc.c
protocol.c
raw_diag.c
raw.c net: drop nopreempt requirement on sock_prot_inuse_add() 2024-07-05 09:14:08 +02:00
route.c ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT 2025-06-27 11:05:31 +01:00
syncookies.c tcp: fix cookie_init_timestamp() overflows 2023-11-20 11:08:16 +01:00
sysctl_net_ipv4.c tcp: restrict net.ipv4.tcp_app_win 2023-04-20 12:13:53 +02:00
tcp_bbr.c
tcp_bic.c
tcp_bpf.c tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection 2025-01-09 13:28:37 +01:00
tcp_cdg.c
tcp_cong.c
tcp_cubic.c tcp_cubic: fix incorrect HyStart round start detection 2025-03-13 12:49:59 +01:00
tcp_dctcp.c tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). 2024-06-16 13:39:47 +02:00
tcp_dctcp.h
tcp_diag.c
tcp_fastopen.c tcp: annotate data-races around fastopenq.max_qlen 2023-07-27 08:47:04 +02:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior 2025-06-27 11:05:36 +01:00
tcp_ipv4.c tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process 2024-10-17 15:11:26 +02:00
tcp_lp.c
tcp_metrics.c tcp_metrics: validate source addr length 2024-07-18 13:07:30 +02:00
tcp_minisocks.c tcp: Defer ts_recent changes until req is owned 2025-03-13 12:50:57 +01:00
tcp_nv.c
tcp_offload.c net-timestamp: support TCP GSO case for a few missing flags 2025-03-13 12:51:07 +01:00
tcp_output.c tcp: check space before adding MPTCP SYN options 2024-12-19 18:07:16 +01:00
tcp_rate.c
tcp_recovery.c tcp: fix excessive TLP and RACK timeouts from HZ rounding 2023-10-25 11:58:57 +02:00
tcp_scalable.c
tcp_timer.c tcp: fix race in tcp_write_err() 2024-08-19 05:44:56 +02:00
tcp_ulp.c
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tcp.c tcp: fix races in tcp_abort() 2025-04-10 14:31:52 +02:00
tunnel4.c
udp_bpf.c bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() 2023-03-17 08:48:54 +01:00
udp_diag.c
udp_impl.h
udp_offload.c net: ipv6: fix UDPv6 GSO segmentation with NAT 2025-05-09 09:39:39 +02:00
udp_tunnel_core.c
udp_tunnel_nic.c
udp_tunnel_stub.c
udp.c udp: gso: do not drop small packets when PMTU reduces 2025-03-13 12:50:22 +01:00
udplite.c udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). 2023-05-30 13:55:31 +01:00
xfrm4_input.c xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:50:57 +02:00
xfrm4_output.c
xfrm4_policy.c xfrm: respect ip protocols rules criteria when performing dst lookups 2024-11-01 01:52:36 +01:00
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c