[PATCH 1/3][v2] tcp: fix ICMP-RTO war: Check lower bound

Make sure, that the returned RTO value does not under-run the valid
minimum RTO as given by tcp_rto_min().
Under some circumstances, TCPs srtt and rttvar are zero,
yielding a calculated RTO of zero.
This is particularly unfortunate for ICMP based RTO recalculation
as introduced in f1ecd5d9e736660 (Revert Backoff [v3]: Revert RTO
on ICMP destination unreachable).
Given an initial RTO of zero, the calculation yields zero independent
of icsk_backoff, which results in RTO retransmission flooding.

Reported-by: Denys Fedoryshchenko <redacted>
Signed-off-by: Damian Lukowski <redacted>
---
 include/net/tcp.h |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 34f5cc2..ff6cbaa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h

@@ -528,9 +528,12 @@ static inline void tcp_bound_rto(const struct sock *sk)
 		inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
 }
 
+static inline u32 tcp_rto_min(struct sock *sk);
 static inline u32 __tcp_set_rto(const struct tcp_sock *tp)
 {
-	return (tp->srtt >> 3) + tp->rttvar;
+	u32 rto = (tp->srtt >> 3) + tp->rttvar;
+	u32 min = tcp_rto_min((struct sock *)tp);
+	return unlikely(rto < min) ? min : rto;
 }
 
 static inline void __tcp_fast_path_on(struct tcp_sock *tp, u32 snd_wnd)

-- 
1.6.4.4

From: Damian Lukowski <redacted>
Date: Fri, 29 Jan 2010 23:15:54 +0100

Don't make assumptions about the layout and relationships
between struct sock and struct tcp_sock without using
the interfaces create for this purpose.

For this case, simply add a "struct sock *" first argument to
__tcp_set_rto() and update the callers.

Thanks.