Commit 2b9f6f70 authored by Altan Hacigumus's avatar Altan Hacigumus Committed by Jakub Kicinski
Browse files

tcp: make probe0 timer handle expired user timeout 

tcp_clamp_probe0_to_user_timeout() computes remaining time in jiffies
using subtraction with an unsigned lvalue.  If elapsed probing time
exceeds the configured TCP_USER_TIMEOUT, the underflow yields a large
value.

This ends up re-arming the probe timer for a full backoff interval
instead of expiring immediately, delaying connection teardown beyond
the configured timeout.

Fix this by preventing underflow so user-set timeout expiration is
handled correctly without extending the probe timer.

Fixes: 344db93a ("tcp: make TCP_USER_TIMEOUT accurate for zero window probes")
Link: https://lore.kernel.org/r/20260414013634.43997-1-ahacigu.linux@gmail.com


Signed-off-by: default avatarAltan Hacigumus <ahacigu.linux@gmail.com>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260424014639.54110-1-ahacigu.linux@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent cc427d24

net/ipv4/tcp_timer.c

+3 −2
Original line number Diff line number Diff line
@@ -50,7 +50,8 @@ static u32 tcp_clamp_rto_to_user_timeout(const struct sock *sk) 
u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when)

{

	const struct inet_connection_sock *icsk = inet_csk(sk);

	u32 remaining, user_timeout;

	u32 user_timeout;

	s32 remaining;

	s32 elapsed;



	user_timeout = READ_ONCE(icsk->icsk_user_timeout);
@@ -61,7 +62,7 @@ u32 tcp_clamp_probe0_to_user_timeout(const struct sock *sk, u32 when) 
	if (unlikely(elapsed < 0))

		elapsed = 0;

	remaining = msecs_to_jiffies(user_timeout) - elapsed;

	remaining = max_t(u32, remaining, TCP_TIMEOUT_MIN);

	remaining = max_t(int, remaining, TCP_TIMEOUT_MIN);



	return min_t(u32, remaining, when);

}