tcp: fix cookie_init_timestamp() overflows

[ Upstream commit 73ed8e03388d16c12fc577e5c700b58a29045a15 ]

cookie_init_timestamp() is supposed to return a 64bit timestamp
suitable for both TSval determination and setting of skb->tstamp.

Unfortunately it uses 32bit fields and overflows after
2^32 * 10^6 nsec (~49 days) of uptime.

Generated TSval are still correct, but skb->tstamp might be set
far away in the past, potentially confusing other layers.

tcp_ns_to_ts() is changed to return a full 64bit value,
ts and ts_now variables are changed to u64 type,
and TSMASK is removed in favor of shifts operations.

While we are at it, change this sequence:
		ts >>= TSBITS;
		ts--;
		ts <<= TSBITS;
		ts |= options;
to:
		ts -= (1UL << TSBITS);

Fixes: 9a568de4818d ("tcp: switch TCP TS option (RFC 7323) to 1ms clock")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 548c75c8a34c7721e251b3c89b911c101960d482..19646fdec23dc3f99b2284c2bc2f6b8a57eab87b 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -810,7 +810,7 @@ static inline u32 tcp_time_stamp(const struct tcp_sock *tp)
 }
 
 /* Convert a nsec timestamp into TCP TSval timestamp (ms based currently) */
-static inline u32 tcp_ns_to_ts(u64 ns)
+static inline u64 tcp_ns_to_ts(u64 ns)
 {
        return div_u64(ns, NSEC_PER_SEC / TCP_TS_HZ);
 }

diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 26fb97d1d4d9a7baa29db4bbd49590aa63badc97..f9514cf87649e1191eaefbb658738185330185fe 100644 (file)
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -41,7 +41,6 @@ static siphash_aligned_key_t syncookie_secret[2];
  * requested/supported by the syn/synack exchange.
  */
 #define TSBITS 6
-#define TSMASK (((__u32)1 << TSBITS) - 1)
 
 static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
                       u32 count, int c)
@@ -62,27 +61,22 @@ static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
  */
 u64 cookie_init_timestamp(struct request_sock *req, u64 now)
 {
-       struct inet_request_sock *ireq;
-       u32 ts, ts_now = tcp_ns_to_ts(now);
+       const struct inet_request_sock *ireq = inet_rsk(req);
+       u64 ts, ts_now = tcp_ns_to_ts(now);
        u32 options = 0;
 
-       ireq = inet_rsk(req);
-
        options = ireq->wscale_ok ? ireq->snd_wscale : TS_OPT_WSCALE_MASK;
        if (ireq->sack_ok)
                options |= TS_OPT_SACK;
        if (ireq->ecn_ok)
                options |= TS_OPT_ECN;
 
-       ts = ts_now & ~TSMASK;
+       ts = (ts_now >> TSBITS) << TSBITS;
        ts |= options;
-       if (ts > ts_now) {
-               ts >>= TSBITS;
-               ts--;
-               ts <<= TSBITS;
-               ts |= options;
-       }
-       return (u64)ts * (NSEC_PER_SEC / TCP_TS_HZ);
+       if (ts > ts_now)
+               ts -= (1UL << TSBITS);
+
+       return ts * (NSEC_PER_SEC / TCP_TS_HZ);
 }