Commit 0f1e4d06 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by David S. Miller
Browse files

tcp: Fix data-races around sysctl_tcp_workaround_signed_windows. 



While reading sysctl_tcp_workaround_signed_windows, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its readers.

Fixes: 15d99e02 ("[TCP]: sysctl to allow TCP window > 32767 sans wscale")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 78047648

net/ipv4/tcp_output.c

+2 −2
Original line number Diff line number Diff line
@@ -230,7 +230,7 @@ void tcp_select_initial_window(const struct sock *sk, int __space, __u32 mss, 
	 * which we interpret as a sign the remote TCP is not

	 * misinterpreting the window field as a signed quantity.

	 */

	if (sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)

	if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows))

		(*rcv_wnd) = min(space, MAX_TCP_WINDOW);

	else

		(*rcv_wnd) = min_t(u32, space, U16_MAX);
@@ -285,7 +285,7 @@ static u16 tcp_select_window(struct sock *sk) 
	 * scaled window.

	 */

	if (!tp->rx_opt.rcv_wscale &&

	    sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows)

	    READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_workaround_signed_windows))

		new_win = min(new_win, MAX_TCP_WINDOW);

	else

		new_win = min(new_win, (65535U << tp->rx_opt.rcv_wscale));

net/mptcp/options.c

+1 −1
Original line number Diff line number Diff line
@@ -1271,7 +1271,7 @@ static void mptcp_set_rwin(struct tcp_sock *tp, struct tcphdr *th) 
		if (unlikely(th->syn))

			new_win = min(new_win, 65535U) << tp->rx_opt.rcv_wscale;

		if (!tp->rx_opt.rcv_wscale &&

		    sock_net(ssk)->ipv4.sysctl_tcp_workaround_signed_windows)

		    READ_ONCE(sock_net(ssk)->ipv4.sysctl_tcp_workaround_signed_windows))

			new_win = min(new_win, MAX_TCP_WINDOW);

		else

			new_win = min(new_win, (65535U << tp->rx_opt.rcv_wscale));