From: Frederic Lecaille <flecaille@haproxy.com>
Date: Thu, 12 Dec 2024 11:04:14 +0000 (+0100)
Subject: BUG/MINOR: quic: underflow issue for bbr_inflight_hi_from_lost_packet()
X-Git-Tag: v3.2-dev2~85
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ebfc301d5d8dbae0c07a9d937bef18d5c3f841c6;p=thirdparty%2Fhaproxy.git

BUG/MINOR: quic: underflow issue for bbr_inflight_hi_from_lost_packet()

Add a test to ensure that values of a local variable used by
bbr_inflight_hi_from_lost_packet() is not be impacted by underflow issues
when subtracting too big numbers and make this function return a correct value.

Must be backported to 3.1.
---

diff --git a/src/quic_cc_bbr.c b/src/quic_cc_bbr.c
index b08c4b5397..fb5c23e757 100644
--- a/src/quic_cc_bbr.c
+++ b/src/quic_cc_bbr.c
@@ -1334,9 +1334,13 @@ static uint64_t bbr_inflight_hi_from_lost_packet(struct quic_cc_rs *rs,
 	BUG_ON(rs->lost < size);
 	/* What was lost before this packet? */
 	lost_prev = rs->lost - size;
+	if (BBR_LOSS_THRESH_MULT * inflight_prev < lost_prev * BBR_LOSS_THRESH_DIVI)
+		return inflight_prev;
+
 	lost_prefix =
 		(BBR_LOSS_THRESH_MULT * inflight_prev - lost_prev * BBR_LOSS_THRESH_DIVI) /
 		(BBR_LOSS_THRESH_DIVI - BBR_LOSS_THRESH_MULT);
+	/* At what inflight value did losses cross BBRLossThresh? */
 	return inflight_prev + lost_prefix;
 }