From a42fad1bdecd30166959f1f0e1b5f816cbc6af69 Mon Sep 17 00:00:00 2001 From: Frederic Lecaille Date: Thu, 12 Dec 2024 12:04:14 +0100 Subject: [PATCH] BUG/MINOR: quic: underflow issue for bbr_inflight_hi_from_lost_packet() Add a test to ensure that values of a local variable used by bbr_inflight_hi_from_lost_packet() is not be impacted by underflow issues when subtracting too big numbers and make this function return a correct value. Must be backported to 3.1. (cherry picked from commit ebfc301d5d8dbae0c07a9d937bef18d5c3f841c6) Signed-off-by: Christopher Faulet --- src/quic_cc_bbr.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/quic_cc_bbr.c b/src/quic_cc_bbr.c index b08c4b5..fb5c23e 100644 --- a/src/quic_cc_bbr.c +++ b/src/quic_cc_bbr.c @@ -1334,9 +1334,13 @@ static uint64_t bbr_inflight_hi_from_lost_packet(struct quic_cc_rs *rs, BUG_ON(rs->lost < size); /* What was lost before this packet? */ lost_prev = rs->lost - size; + if (BBR_LOSS_THRESH_MULT * inflight_prev < lost_prev * BBR_LOSS_THRESH_DIVI) + return inflight_prev; + lost_prefix = (BBR_LOSS_THRESH_MULT * inflight_prev - lost_prev * BBR_LOSS_THRESH_DIVI) / (BBR_LOSS_THRESH_DIVI - BBR_LOSS_THRESH_MULT); + /* At what inflight value did losses cross BBRLossThresh? */ return inflight_prev + lost_prefix; } -- 1.7.10.4