From: Jakub Kicinski <kuba@kernel.org>
To: Michael Cohen <michael.cohen3@mail.huji.ac.il>
Cc: netdev@vger.kernel.org, edumazet@google.com,
ncardwell@google.com, kuniyu@google.com, davem@davemloft.net,
pabeni@redhat.com, horms@kernel.org,
Tamir Shahar <tamir.shahar1@gmail.com>,
Amit Klein <amit.klein@mail.huji.ac.il>
Subject: Re: [PATCH net] tcp: reject completely old segments during sequence validation
Date: Thu, 20 Aug 2026 14:26:18 -0700 [thread overview]
Message-ID: <20260820142618.7378ac15@kernel.org> (raw)
In-Reply-To: <20260818205230.1146138-1-michael.cohen3@mail.huji.ac.il>
On Tue, 18 Aug 2026 23:52:30 +0300 Michael Cohen wrote:
> tcp_sequence() rejects an incoming segment when end_seq is before
> rcv_wup. Since end_seq is one past the last sequence number consumed by
> the segment, this misses the boundary case where end_seq is equal to
> rcv_wup.
>
> A segment that consumes sequence space and has end_seq equal to rcv_wup
> is therefore allowed to reach later processing, including ACK handling,
> even though it should be rejected as a completely old segment.
>
> Reject this boundary case while retaining the existing behavior for
> segments that consume no sequence space.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Michael Cohen <michael.cohen3@mail.huji.ac.il>
> Reported-by: Tamir Shahar <tamir.shahar1@gmail.com>
> Reported-by: Amit Klein <amit.klein@mail.huji.ac.il>
> Signed-off-by: Michael Cohen <michael.cohen3@mail.huji.ac.il>
CI says the AccECN cases need to be adjusted.
Example failure output (tcp_accecn_synack_rexmit.pkt):
tcp_accecn_synack_rexmit.pkt:15: error handling packet: live packet field
tcp_ece: expected: 0 (0x0) vs actual: 1 (0x1)
script packet: 0.104 .W 1:1(0) ack 1 <ECN e1b 1 ceb 0 e0b 1,nop>
actual packet: 0.102 .EA 1:1(0) ack 1 win 1050 <ECN e1b 1 ceb 0 e0b 1,nop>
The AccECN tests expect the kernel to observe and react to the retransmitted
SYN-ACK, but the new boundary rejection prevents that.
prev parent reply other threads:[~2026-08-20 21:26 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-18 20:52 [PATCH net] tcp: reject completely old segments during sequence validation Michael Cohen
2026-08-20 21:25 ` Jakub Kicinski
2026-08-20 21:26 ` Jakub Kicinski [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260820142618.7378ac15@kernel.org \
--to=kuba@kernel.org \
--cc=amit.klein@mail.huji.ac.il \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuniyu@google.com \
--cc=michael.cohen3@mail.huji.ac.il \
--cc=ncardwell@google.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=tamir.shahar1@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.