Commit edafe502 authored by Daniele Lacamera's avatar Daniele Lacamera Committed by David S. Miller

TCP: tcp_hybla: Fix integer overflow in slow start increment

For large values of rtt, 2^rho operation may overflow u32. Clamp down the increment to 2^16.
Signed-off-by: default avatarDaniele Lacamera <root@danielinux.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 33c29dde
...@@ -126,8 +126,8 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 in_flight) ...@@ -126,8 +126,8 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
* calculate 2^fract in a <<7 value. * calculate 2^fract in a <<7 value.
*/ */
is_slowstart = 1; is_slowstart = 1;
increment = ((1 << ca->rho) * hybla_fraction(rho_fractions)) increment = ((1 << min(ca->rho, 16U)) *
- 128; hybla_fraction(rho_fractions)) - 128;
} else { } else {
/* /*
* congestion avoidance * congestion avoidance
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment