Path: news.gmane.org!not-for-mail From: Jesper Dangaard Brouer Newsgroups: gmane.linux.network Subject: [net PATCH V2] net: fix divide by zero in tcp algorithm illinois Date: Wed, 31 Oct 2012 13:45:32 +0100 Lines: 63 Approved: news@gmane.org Message-ID: <20121031124318.30915.32293.stgit@dragon> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1351687472 19921 80.91.229.3 (31 Oct 2012 12:44:32 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 31 Oct 2012 12:44:32 +0000 (UTC) Cc: Jesper Dangaard Brouer , netdev@vger.kernel.org, Petr Matousek , Stephen Hemminger , Eric Dumazet To: "David S. Miller" Original-X-From: netdev-owner@vger.kernel.org Wed Oct 31 13:44:40 2012 Return-path: Envelope-to: linux-netdev-2@plane.gmane.org Original-Received: from vger.kernel.org ([209.132.180.67]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1TTXex-0002V3-Qk for linux-netdev-2@plane.gmane.org; Wed, 31 Oct 2012 13:44:40 +0100 Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932565Ab2JaMo0 (ORCPT ); Wed, 31 Oct 2012 08:44:26 -0400 Original-Received: from mx1.redhat.com ([209.132.183.28]:57345 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751941Ab2JaMoZ (ORCPT ); Wed, 31 Oct 2012 08:44:25 -0400 Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q9VCiOkC014655 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 31 Oct 2012 08:44:24 -0400 Original-Received: from dragon.localdomain (ovpn-116-61.ams2.redhat.com [10.36.116.61]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q9VCiMuW008440; Wed, 31 Oct 2012 08:44:23 -0400 Original-Received: from [127.0.0.1] (localhost [IPv6:::1]) by dragon.localdomain (Postfix) with ESMTP id 416D0E40666; Wed, 31 Oct 2012 13:45:32 +0100 (CET) User-Agent: StGIT/0.14.3 X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 Original-Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Xref: news.gmane.org gmane.linux.network:247871 Archived-At: Reading TCP stats when using TCP Illinois congestion control algorithm can cause a divide by zero kernel oops. The division by zero occur in tcp_illinois_info() at: do_div(t, ca->cnt_rtt); where ca->cnt_rtt can become zero (when rtt_reset is called) Steps to Reproduce: 1. Register tcp_illinois: # sysctl -w net.ipv4.tcp_congestion_control=illinois 2. Monitor internal TCP information via command "ss -i" # watch -d ss -i 3. Establish new TCP conn to machine Either it fails at the initial conn, or else it needs to wait for a loss or a reset. This is only related to reading stats. The function avg_delay() also performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its calling point in update_params(). Thus, simply fix tcp_illinois_info(). Function tcp_illinois_info() / get_info() is called without socket lock. Thus, eliminate any race condition on ca->cnt_rtt by using a local stack variable. Simply reuse info.tcpv_rttcnt, as its already set to ca->cnt_rtt. Function avg_delay() is not affected by this race condition, as its called with the socket lock. Cc: Petr Matousek Signed-off-by: Jesper Dangaard Brouer --- V2: Address Eric Dumazets input: - Save 2 bytes of stack, by using info.tcpv_rttcnt. - Help compiler, and define "u64 t" inside if() lexical scope. net/ipv4/tcp_illinois.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-) diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c index 813b43a..834857f 100644 --- a/net/ipv4/tcp_illinois.c +++ b/net/ipv4/tcp_illinois.c @@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext, .tcpv_rttcnt = ca->cnt_rtt, .tcpv_minrtt = ca->base_rtt, }; - u64 t = ca->sum_rtt; - do_div(t, ca->cnt_rtt); - info.tcpv_rtt = t; + if (info.tcpv_rttcnt > 0) { + u64 t = ca->sum_rtt; + do_div(t, info.tcpv_rttcnt); + info.tcpv_rtt = t; + } nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info); } }