BUG/MINOR: quic: SIGFPE in quic_cubic_update()

As reported by @Tristan971 in GH #2116, the congestion control window could be zero
due to an inversion in the code about the reduction factor to be applied.
On a new loss event, it must be applied to the slow start threshold and the window
should never be below ->min_cwnd (2*max_udp_payload_sz).

Same issue in both newReno and cubic algorithm. Furthermore in newReno, only the
threshold was decremented.

Must be backported to 2.6 and 2.7.

diff --git a/src/quic_cc_cubic.c b/src/quic_cc_cubic.c
index d22897b372b5c363668c8a98014437b4aa61f799..fd7fef5a231f3e912190d5209fd8f108cd0d095c 100644 (file)
--- a/src/quic_cc_cubic.c
+++ b/src/quic_cc_cubic.c
@@ -197,8 +197,8 @@ static void quic_enter_recovery(struct quic_cc *cc)
        else {
                c->last_w_max = path->cwnd;
        }
-       path->cwnd = (CUBIC_BETA * path->cwnd) >> CUBIC_BETA_SCALE_SHIFT;
-       c->ssthresh =  QUIC_MAX(path->cwnd, path->min_cwnd);
+       c->ssthresh = (CUBIC_BETA * path->cwnd) >> CUBIC_BETA_SCALE_SHIFT;
+       path->cwnd =  QUIC_MAX(c->ssthresh, (uint32_t)path->min_cwnd);
        c->state = QUIC_CC_ST_RP;
        TRACE_LEAVE(QUIC_EV_CONN_CC, cc->qc, NULL, cc);
 }

diff --git a/src/quic_cc_newreno.c b/src/quic_cc_newreno.c
index 65763d76246161379e42f19575d70902ed8ac6b6..9b132482df3e4c715ba3b20ed80a0b31d553519c 100644 (file)
--- a/src/quic_cc_newreno.c
+++ b/src/quic_cc_newreno.c
@@ -71,7 +71,8 @@ static void quic_cc_nr_enter_recovery(struct quic_cc *cc)
 
        path = container_of(cc, struct quic_path, cc);
        nr->recovery_start_time = now_ms;
-       nr->ssthresh = QUIC_MAX(path->cwnd >> 1, path->min_cwnd);
+       nr->ssthresh = path->cwnd >> 1;
+       path->cwnd = QUIC_MAX(nr->ssthresh, (uint32_t)path->min_cwnd);
        nr->state = QUIC_CC_ST_RP;
 }