git: 7b9f6ebb9268 - stable/14 - tcp: ensure SACK rxmit never ends up left of its hole

The branch stable/14 has been updated by rscheff:

URL: https://cgit.FreeBSD.org/src/commit/?id=7b9f6ebb9268defdfa4403abdf4b12282110f4c8

commit 7b9f6ebb9268defdfa4403abdf4b12282110f4c8
Author:     Richard Scheffenegger <rscheff@FreeBSD.org>
AuthorDate: 2025-08-06 20:25:30 +0000
Commit:     Richard Scheffenegger <rscheff@FreeBSD.org>
CommitDate: 2025-08-13 19:19:25 +0000

    tcp: ensure SACK rxmit never ends up left of its hole
    
    When a RTO happens during SACK loss recovery, snd_recover can possibly pulled left.
    With Lost Retransmission Detection (LRD) this can lead to rxmit of a hole to end up
    pointing to the left of the hole, which is unexpected and leads to complications.
    
    Reviewed By: tuexen, #transport
    Sponsored by: NetApp, Inc.
    MFC after: 1 week
    Differential Revision: https://reviews.freebsd.org/D51725
    
    (cherry picked from commit 65d4a83399843cb4c6dd44061599390843c162db)
---
 sys/netinet/tcp_output.c | 2 +-
 sys/netinet/tcp_sack.c   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index 9855083b579a..a8e2a18f72da 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -1255,7 +1255,7 @@ send:
 		 * fack acks recoverypoint.
 		 */
 		if ((tp->t_flags & TF_LRD) && SEQ_GEQ(p->rxmit, p->end))
-			p->rxmit = tp->snd_recover;
+			p->rxmit = SEQ_MAX(p->rxmit, tp->snd_recover);
 		tp->sackhint.sack_bytes_rexmit += len;
 	}
 	if (IN_RECOVERY(tp->t_flags)) {
diff --git a/sys/netinet/tcp_sack.c b/sys/netinet/tcp_sack.c
index f33c7030f21e..cc02263512da 100644
--- a/sys/netinet/tcp_sack.c
+++ b/sys/netinet/tcp_sack.c
@@ -770,7 +770,7 @@ tcp_sack_doack(struct tcpcb *tp, struct tcpopt *to, tcp_seq th_ack)
 				cur->end = sblkp->start;
 				cur->rxmit = SEQ_MIN(cur->rxmit, cur->end);
 				if ((tp->t_flags & TF_LRD) && SEQ_GEQ(cur->rxmit, cur->end))
-					cur->rxmit = tp->snd_recover;
+					cur->rxmit = SEQ_MAX(cur->rxmit, tp->snd_recover);
 			} else {
 				/*
 				 * ACKs some data in middle of a hole; need
@@ -790,7 +790,7 @@ tcp_sack_doack(struct tcpcb *tp, struct tcpopt *to, tcp_seq th_ack)
 					cur->rxmit = SEQ_MIN(cur->rxmit,
 					    cur->end);
 					if ((tp->t_flags & TF_LRD) && SEQ_GEQ(cur->rxmit, cur->end))
-						cur->rxmit = tp->snd_recover;
+						cur->rxmit = SEQ_MAX(cur->rxmit, tp->snd_recover);
 					delivered_data += (sblkp->end - sblkp->start);
 				}
 			}