[PATCH net 0/2] tcp/mptcp: prevent blackhole timeout arithmetic wraparound

[Yingjie Wang <x-professor@outlook.com>]

The TCP Fast Open and MPTCP blackhole handlers multiply writable timeout
sysctl values before adding the result to a jiffies timestamp. The
multiplication is performed in 32-bit unsigned arithmetic, so a large
value can wrap into a short delay even on a 64-bit kernel.

With HZ=1000, a timeout of 6912213 seconds and the maximum multiplier of
64 should produce 442381632000 jiffies, but the current calculations
truncate the result to 512 jiffies. Both patches compute the delay in u64
and cap it at MAX_JIFFY_OFFSET before adding it to the saved timestamp.

The issues were found using a static analysis tool. A loopback reproducer
induced 12 blackholes, waited 1.2 seconds, and then made a new connection:

  TFO:   base probe 1.026 s, TCPFastOpenActiveFail +1;
         fixed probe 0.000 s, TCPFastOpenActiveFail +0.
  MPTCP: base probe 3.087 s, MPCapableSYNTXDisabled +0;
         fixed probe 0.000 s, MPCapableSYNTXDisabled +1.

The TFO counter records another failed active Fast Open attempt. The
MPTCP counter records a connection that skips MP_CAPABLE and falls back
to TCP while active MPTCP is disabled.

The base and fixed kernels used the same x86-64 HZ=1000 configuration.
The changed objects also build cleanly with W=1 under i386 defconfig,
with MPTCP, IPv6, and sysctl enabled. The i386 objects have no undefined
64-bit multiplication or division helper.

The current objects have identical disassembly and relocations to the
min_t() version on both architectures; the x86-64 objects also match
those from the runtime-tested kernel.

The runtime configuration had KASAN and UBSAN disabled. No BUG, WARNING,
or Oops diagnostic appeared. TCP and MPTCP selftests were not run.

The patches are independent and have separate Fixes tags.

Yingjie Wang (2):
  tcp: avoid wrapping Fast Open blackhole timeout
  mptcp: avoid wrapping blackhole timeout

 net/ipv4/tcp_fastopen.c | 4 +++-
 net/mptcp/ctrl.c        | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)


base-commit: 30c71476d842b094651bd7712f6c8ee8716147d0
-- 
2.43.0