1d464c26b5
I've traced down an off-by-one TCP checksum calculation error under the following conditions: 1) The TCP code needs to split a full-sized packet due to a reduced MSS (typically due to the addition of TCP options mid-stream like SACK). _AND_ 2) The checksum of the 2nd fragment is larger than the checksum of the original packet. After subtraction this results in a checksum for the 1st fragment with bits 16..31 set to 1. (this is ok) _AND_ 3) The checksum of the 1st fragment's TCP header plus the previously 32bit checksum of the 1st fragment DOES NOT cause a 32bit overflow when added together. This results in a checksum of the TCP header plus TCP data that still has the upper 16 bits as 1's. _THEN_ 4) The TCP+data checksum is added to the checksum of the pseudo IP header with csum_tcpudp_nofold() incorrectly (the bug). The problem is the checksum of the TCP+data is passed to csum_tcpudp_nofold() as an 32bit unsigned value, however the assembly code acts on it as if it is a 64bit unsigned value. This causes an incorrect 32->64bit extension if the sum has bit 31 set. The resulting checksum is off by one. This problems is data and TCP header dependent due to #2 and #3 above so it doesn't occur on every TCP packet split. Signed-off-by: Dave Johnson <djohnson+linux-mips@sw.starentnetworks.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org> |
||
---|---|---|
.. | ||
arc | ||
ddb5xxx | ||
dec | ||
emma2rh | ||
ip32 | ||
jmr3927 | ||
lasat | ||
mach-atlas | ||
mach-au1x00 | ||
mach-cobalt | ||
mach-db1x00 | ||
mach-dec | ||
mach-emma2rh | ||
mach-ev64120 | ||
mach-excite | ||
mach-generic | ||
mach-ip22 | ||
mach-ip27 | ||
mach-ip32 | ||
mach-ja | ||
mach-jazz | ||
mach-jmr3927 | ||
mach-lasat | ||
mach-mips | ||
mach-ocelot | ||
mach-ocelot3 | ||
mach-pb1x00 | ||
mach-pnx8550 | ||
mach-qemu | ||
mach-rm | ||
mach-sibyte | ||
mach-sim | ||
mach-vr41xx | ||
mach-wrppmc | ||
mach-yosemite | ||
mips-boards | ||
pci | ||
sgi | ||
sibyte | ||
sn | ||
tx4927 | ||
tx4938 | ||
vr41xx | ||
xtalk | ||
8253pit.h | ||
a.out.h | ||
abi.h | ||
addrspace.h | ||
asm.h | ||
asmmacro-32.h | ||
asmmacro-64.h | ||
asmmacro.h | ||
atomic.h | ||
auxvec.h | ||
barrier.h | ||
bcache.h | ||
bitops.h | ||
bootinfo.h | ||
branch.h | ||
break.h | ||
bug.h | ||
bugs.h | ||
byteorder.h | ||
cache.h | ||
cachectl.h | ||
cacheflush.h | ||
cacheops.h | ||
checksum.h | ||
compat-signal.h | ||
compat.h | ||
compiler.h | ||
cpu-features.h | ||
cpu-info.h | ||
cpu.h | ||
cputime.h | ||
current.h | ||
debug.h | ||
delay.h | ||
device.h | ||
div64.h | ||
dma-mapping.h | ||
dma.h | ||
ds1216.h | ||
ds1286.h | ||
dsp.h | ||
elf.h | ||
emergency-restart.h | ||
errno.h | ||
fcntl.h | ||
fixmap.h | ||
floppy.h | ||
fpregdef.h | ||
fpu_emulator.h | ||
fpu.h | ||
futex.h | ||
gdb-stub.h | ||
gfx.h | ||
gt64120.h | ||
gt64240.h | ||
hardirq.h | ||
hazards.h | ||
highmem.h | ||
hw_irq.h | ||
i8259.h | ||
ide.h | ||
inst.h | ||
inventory.h | ||
io.h | ||
ioctl.h | ||
ioctls.h | ||
ipc.h | ||
ipcbuf.h | ||
irq_cpu.h | ||
irq_regs.h | ||
irq.h | ||
irqflags.h | ||
isadep.h | ||
jazz.h | ||
jazzdma.h | ||
Kbuild | ||
kexec.h | ||
kmap_types.h | ||
kspd.h | ||
linkage.h | ||
local.h | ||
m48t35.h | ||
m48t37.h | ||
marvell.h | ||
mc146818-time.h | ||
mc146818rtc.h | ||
mips_mt.h | ||
mipsmtregs.h | ||
mipsprom.h | ||
mipsregs.h | ||
mman.h | ||
mmu_context.h | ||
mmu.h | ||
mmzone.h | ||
module.h | ||
msc01_ic.h | ||
msgbuf.h | ||
mutex.h | ||
namei.h | ||
nile4.h | ||
paccess.h | ||
page.h | ||
param.h | ||
parport.h | ||
pci.h | ||
percpu.h | ||
pgalloc.h | ||
pgtable-32.h | ||
pgtable-64.h | ||
pgtable-bits.h | ||
pgtable.h | ||
pmon.h | ||
poll.h | ||
posix_types.h | ||
prctl.h | ||
prefetch.h | ||
processor.h | ||
ptrace.h | ||
qemu.h | ||
r4kcache.h | ||
reboot.h | ||
reg.h | ||
regdef.h | ||
resource.h | ||
rm9k-ocd.h | ||
rtc.h | ||
rtlx.h | ||
scatterlist.h | ||
sections.h | ||
segment.h | ||
semaphore.h | ||
sembuf.h | ||
serial.h | ||
setup.h | ||
sgialib.h | ||
sgiarcs.h | ||
sgidefs.h | ||
shmbuf.h | ||
shmparam.h | ||
sigcontext.h | ||
siginfo.h | ||
signal.h | ||
sim.h | ||
smp.h | ||
smtc_ipi.h | ||
smtc_proc.h | ||
smtc.h | ||
sni.h | ||
socket.h | ||
sockios.h | ||
sparsemem.h | ||
spinlock_types.h | ||
spinlock.h | ||
stackframe.h | ||
stacktrace.h | ||
stat.h | ||
statfs.h | ||
string.h | ||
suspend.h | ||
sysmips.h | ||
system.h | ||
termbits.h | ||
termios.h | ||
thread_info.h | ||
time.h | ||
timex.h | ||
titan_dep.h | ||
tlb.h | ||
tlbdebug.h | ||
tlbflush.h | ||
topology.h | ||
traps.h | ||
tx3912.h | ||
types.h | ||
uaccess.h | ||
ucontext.h | ||
unaligned.h | ||
unistd.h | ||
user.h | ||
vga.h | ||
vpe.h | ||
war.h | ||
watch.h | ||
wbflush.h | ||
xor.h | ||
xxs1500.h |