Alexey Dobriyan 0147fc058d tcp: restrict net.ipv4.tcp_adv_win_scale (#20312)
tcp_win_from_space() does the following:

      if (sysctl_tcp_adv_win_scale <= 0)
              return space >> (-sysctl_tcp_adv_win_scale);
      else
              return space - (space >> sysctl_tcp_adv_win_scale);

"space" is int.

As per C99 6.5.7 (3) shifting int for 32 or more bits is
undefined behaviour.

Indeed, if sysctl_tcp_adv_win_scale is exactly 32,
space >> 32 equals space and function returns 0.

Which means we busyloop in tcp_fixup_rcvbuf().

Restrict net.ipv4.tcp_adv_win_scale to [-31, 31].

Fix https://bugzilla.kernel.org/show_bug.cgi?id=20312

Steps to reproduce:

      echo 32 >/proc/sys/net/ipv4/tcp_adv_win_scale
      wget www.kernel.org
      [softlockup]

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-11-28 10:39:45 -08:00
..
2010-10-25 13:09:44 -07:00
2010-10-25 13:09:43 -07:00
2010-11-12 14:07:14 -08:00
2010-10-28 10:27:01 -07:00
2010-11-10 12:12:00 -08:00
2010-11-24 11:51:47 -08:00
2010-09-23 14:33:39 -07:00
2010-10-21 15:44:13 +02:00
2010-09-23 14:33:39 -07:00
2010-04-20 16:37:13 -07:00
2010-11-10 12:12:00 -08:00
2010-10-29 04:16:28 -04:00
2010-11-24 09:15:27 -08:00
2010-08-09 11:25:17 +02:00
2010-10-15 15:53:27 +02:00