svn commit: r194462 - stable/7/sys/netinet

[John Baldwin]

Author: jhb
Date: Thu Jun 18 21:17:04 2009
New Revision: 194462
URL: http://svn.freebsd.org/changeset/base/194462

Log:
  MFC: Fix overflow edge cases with comparing ticks to t_rcvtime including
  fixing the TCP keepalive timer to work properly when ticks overflows from
  INT_MAX to INT_MIN.  Note that to preserve the ABI this change just
  downcasts t_rcvtime to an int when it is subtracted from ticks rather than
  changing the type of t_rcvtime.

Modified:
  stable/7/sys/netinet/tcp_output.c
  stable/7/sys/netinet/tcp_timer.c

Modified: stable/7/sys/netinet/tcp_output.c
==============================================================================
--- stable/7/sys/netinet/tcp_output.c	Thu Jun 18 21:15:41 2009	(r194461)
+++ stable/7/sys/netinet/tcp_output.c	Thu Jun 18 21:17:04 2009	(r194462)
@@ -161,7 +161,7 @@ tcp_output(struct tcpcb *tp)
 	 * to send, then transmit; otherwise, investigate further.
 	 */
 	idle = (tp->t_flags & TF_LASTIDLE) || (tp->snd_max == tp->snd_una);
-	if (idle && (ticks - tp->t_rcvtime) >= tp->t_rxtcur) {
+	if (idle && (ticks - (int)tp->t_rcvtime) >= tp->t_rxtcur) {
 		/*
 		 * We have been idle for "a while" and no acks are
 		 * expected to clock out any data we send --

Modified: stable/7/sys/netinet/tcp_timer.c
==============================================================================
--- stable/7/sys/netinet/tcp_timer.c	Thu Jun 18 21:15:41 2009	(r194461)
+++ stable/7/sys/netinet/tcp_timer.c	Thu Jun 18 21:17:04 2009	(r194462)
@@ -234,7 +234,7 @@ tcp_timer_2msl(void *xtp)
 		tp = tcp_close(tp);             
 	} else {
 		if (tp->t_state != TCPS_TIME_WAIT &&
-		   (ticks - tp->t_rcvtime) <= tcp_maxidle)
+		    (ticks - (int)tp->t_rcvtime) <= tcp_maxidle)
 		       callout_reset(&tp->t_timers->tt_2msl, tcp_keepintvl,
 				     tcp_timer_2msl, tp);
 	       else
@@ -293,7 +293,7 @@ tcp_timer_keep(void *xtp)
 		goto dropit;
 	if ((always_keepalive || inp->inp_socket->so_options & SO_KEEPALIVE) &&
 	    tp->t_state <= TCPS_CLOSING) {
-		if ((ticks - tp->t_rcvtime) >= tcp_keepidle + tcp_maxidle)
+		if ((ticks - (int)tp->t_rcvtime) >= tcp_keepidle + tcp_maxidle)
 			goto dropit;
 		/*
 		 * Send a packet designed to force a response
@@ -387,8 +387,8 @@ tcp_timer_persist(void *xtp)
 	 * backoff that we would use if retransmitting.
 	 */
 	if (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
-	    ((ticks - tp->t_rcvtime) >= tcp_maxpersistidle ||
-	     (ticks - tp->t_rcvtime) >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
+	    ((ticks - (int)tp->t_rcvtime) >= tcp_maxpersistidle ||
+	     (ticks - (int)tp->t_rcvtime) >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
 		tcpstat.tcps_persistdrop++;
 		tp = tcp_drop(tp, ETIMEDOUT);
 		goto out;