Eric Dumazet 12fb3dd9dc tcp: call tcp_replace_ts_recent() from tcp_ack() ... commit bd090dfc63 (tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()) introduced a TS ecr bug in slow path processing. 1 A > B P. 1:10001(10000) ack 1 <nop,nop,TS val 1001 ecr 200> 2 B < A . 1:1(0) ack 1 win 257 <sack 9001:10001,TS val 300 ecr 1001> 3 A > B . 1:1001(1000) ack 1 win 227 <nop,nop,TS val 1002 ecr 200> 4 A > B . 1001:2001(1000) ack 1 win 227 <nop,nop,TS val 1002 ecr 200> (ecr 200 should be ecr 300 in packets 3 & 4) Problem is tcp_ack() can trigger send of new packets (retransmits), reflecting the prior TSval, instead of the TSval contained in the currently processed incoming packet. Fix this by calling tcp_replace_ts_recent() from tcp_ack() after the checks, but before the actions. Reported-by: Yuchung Cheng <ycheng@google.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Neal Cardwell <ncardwell@google.com> Acked-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-04-19 14:21:53 -04:00
..
9p	Revert parts of "hlist: drop the node parameter from iterators"	2013-03-08 15:05:34 -08:00
802	net/802/mrp: fix possible race condition when calling mrp_pdu_queue()	2013-04-12 15:10:48 -04:00
8021q	8021q: fix a potential use-after-free	2013-03-24 17:27:28 -04:00
appletalk	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
atm	atm: update msg_namelen in vcc_recvmsg()	2013-04-07 16:28:00 -04:00
ax25	ax25: fix info leak via msg_name in ax25_recvmsg()	2013-04-07 16:28:00 -04:00
batman-adv	batman-adv: make is_my_mac() check for the current mesh only	2013-04-17 22:31:22 +02:00
bluetooth	Bluetooth: SCO - Fix missing msg_namelen update in sco_sock_recvmsg()	2013-04-07 16:28:01 -04:00
bridge	bridge: make user modified path cost sticky	2013-04-15 14:03:44 -04:00
caif	caif: Fix missing msg_namelen update in caif_seqpkt_recvmsg()	2013-04-07 16:28:01 -04:00
can	can: gw: use kmem_cache_free() instead of kfree()	2013-04-09 09:58:44 +02:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2013-03-12 09:22:42 -07:00
core	rtnetlink: Call nlmsg_parse() with correct header length	2013-04-08 17:12:26 -04:00
dcb	dcbnl: fix various netlink info leaks	2013-03-10 05:19:26 -04:00
dccp	Driver core patches for 3.9-rc1	2013-02-21 12:05:51 -08:00
decnet	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
dns_resolver	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2012-12-16 15:40:50 -08:00
dsa	dsa: make dsa_switch_setup check for valid port names	2013-01-21 15:40:12 -05:00
ethernet	net: split eth_mac_addr for better error handling	2013-01-21 14:07:44 -05:00
ieee802154	6lowpan: Fix endianness issue in is_addr_link_local().	2013-03-10 16:49:35 -04:00
ipv4	tcp: call tcp_replace_ts_recent() from tcp_ack()	2013-04-19 14:21:53 -04:00
ipv6	net: drop dst before queueing fragments	2013-04-17 01:15:29 -04:00
ipx	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
irda	irda: Fix missing msg_namelen update in irda_recvmsg_dgram()	2013-04-07 16:28:01 -04:00
iucv	af_iucv: fix recvmsg by replacing skb_pull() function	2013-04-08 17:16:57 -04:00
key	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2013-03-27 14:07:04 -04:00
l2tp	l2tp: fix info leak in l2tp_ip6_recvmsg()	2013-04-07 16:28:01 -04:00
lapb	net/lapb: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:40:01 -08:00
llc	llc: Fix missing msg_namelen update in llc_ui_recvmsg()	2013-04-07 16:28:01 -04:00
mac80211	Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211	2013-04-01 15:09:28 -04:00
mac802154	Driver core patches for 3.9-rc1	2013-02-21 12:05:51 -08:00
netfilter	netfilter: nf_nat: fix race when unloading protocol modules	2013-04-12 11:46:31 +02:00
netlabel	netlabel: fix build problems when CONFIG_IPV6=n	2013-03-08 11:33:51 -05:00
netlink	genetlink: trigger BUG_ON if a group name is too long	2013-03-20 12:05:51 -04:00
netrom	netrom: fix invalid use of sizeof in nr_recvmsg()	2013-04-08 22:49:23 -04:00
nfc	NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg()	2013-04-07 16:28:02 -04:00
openvswitch	openvswitch: correct an invalid BUG_ON	2013-03-27 09:07:41 -07:00
packet	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
phonet	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
rds	net/rds: zero last byte for strncpy	2013-03-08 00:35:44 -05:00
rfkill	rfkill: don't use [delayed_]work_pending()	2012-12-28 13:40:16 -08:00
rose	rose: fix info leak via msg_name in rose_recvmsg()	2013-04-07 16:28:02 -04:00
rxrpc	Driver core patches for 3.9-rc1	2013-02-21 12:05:51 -08:00
sched	cbq: incorrect processing of high limits	2013-04-02 14:29:20 -04:00
sctp	sctp: don't break the loop while meeting the active_path so as to find the matched transport	2013-03-13 10:09:55 -04:00
sunrpc	NFS client bugfixes for Linux 3.9	2013-04-10 09:00:51 -07:00
tipc	tipc: fix info leaks via msg_name in recv_msg/recv_stream	2013-04-07 16:28:02 -04:00
unix	af_unix: If we don't care about credentials coallesce all messages	2013-04-05 00:49:13 -04:00
vmw_vsock	VSOCK: Fix missing msg_namelen update in vsock_stream_recvmsg()	2013-04-07 16:28:02 -04:00
wimax
wireless	Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211	2013-04-03 14:19:48 -04:00
x25	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec	2013-03-27 14:07:04 -04:00
compat.c	make get_file() return its argument	2012-09-26 21:10:25 -04:00
Kconfig	Driver core patches for 3.9-rc1	2013-02-21 12:05:51 -08:00
Makefile	VSOCK: Introduce VM Sockets	2013-02-10 19:41:08 -05:00
nonet.c
socket.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-02-26 20:16:07 -08:00
sysctl_net.c	user_ns: get rid of duplicate code in net_ctl_permissions	2012-11-18 20:32:45 -05:00