BUG/MINOR: quic: Missing in flight ack eliciting packet counter decrement

The decrement was missing in quic_pktns_tx_pkts_release() called each time a
packet number space is discarded. This is not sure this bug could have an impact
during handshakes. This counter is used to cancel the timer used both for packet
detection and PTO, setting its value to null. So there could be retransmissions
or probing which could be triggered for nothing.

Must be backported to 2.6.
This commit is contained in:
Frédéric Lécaille 2022-08-01 14:07:50 +02:00
parent 6bb86539db
commit 8ddde4f05e
2 changed files with 5 additions and 3 deletions

View File

@ -542,7 +542,7 @@ static inline void quic_tx_packet_refdec(struct quic_tx_packet *pkt)
}
}
static inline void quic_pktns_tx_pkts_release(struct quic_pktns *pktns)
static inline void quic_pktns_tx_pkts_release(struct quic_pktns *pktns, struct quic_conn *qc)
{
struct eb64_node *node;
@ -553,6 +553,8 @@ static inline void quic_pktns_tx_pkts_release(struct quic_pktns *pktns)
pkt = eb64_entry(node, struct quic_tx_packet, pn_node);
node = eb64_next(node);
if (pkt->flags & QUIC_FL_TX_PACKET_ACK_ELICITING)
qc->path->ifae_pkts--;
list_for_each_entry_safe(frm, frmbak, &pkt->frms, list) {
LIST_DELETE(&frm->list);
quic_tx_packet_refdec(frm->pkt);
@ -581,7 +583,7 @@ static inline void quic_pktns_discard(struct quic_pktns *pktns,
pktns->tx.loss_time = TICK_ETERNITY;
pktns->tx.pto_probe = 0;
pktns->tx.in_flight = 0;
quic_pktns_tx_pkts_release(pktns);
quic_pktns_tx_pkts_release(pktns, qc);
}
/* Initialize <p> QUIC network path depending on <ipv4> boolean

View File

@ -4137,7 +4137,7 @@ static void quic_conn_release(struct quic_conn *qc)
pool_free(pool_head_quic_tls_secret, app_tls_ctx->tx.secret);
for (i = 0; i < QUIC_TLS_PKTNS_MAX; i++) {
quic_pktns_tx_pkts_release(&qc->pktns[i]);
quic_pktns_tx_pkts_release(&qc->pktns[i], qc);
quic_free_arngs(&qc->pktns[i].rx.arngs);
}