session: fix use-after-free

[vpp.git] / src / vnet / session / transport.c

diff --git a/src/vnet/session/transport.c b/src/vnet/session/transport.c
index c1c908e..3e72399 100644 (file)
--- a/src/vnet/session/transport.c
+++ b/src/vnet/session/transport.c
@@ -49,7 +49,7 @@ static double transport_pacer_period;
 
 #define TRANSPORT_PACER_MIN_MSS        1460
 #define TRANSPORT_PACER_MIN_BURST      TRANSPORT_PACER_MIN_MSS
-#define TRANSPORT_PACER_MAX_BURST      (32 * TRANSPORT_PACER_MIN_MSS)
+#define TRANSPORT_PACER_MAX_BURST      (43 * TRANSPORT_PACER_MIN_MSS)
 
 u8 *
 format_transport_proto (u8 * s, va_list * args)
@@ -578,10 +578,11 @@ spacer_max_burst (spacer_t * pacer, u64 norm_time_now)
   u64 n_periods = norm_time_now - pacer->last_update;
   u64 inc;
 
-  if (n_periods > 0 && (inc = n_periods * pacer->tokens_per_period) > 10)
+  if (n_periods > 0
+      && (inc = (f32) n_periods * pacer->tokens_per_period) > 10)
     {
       pacer->last_update = norm_time_now;
-      pacer->bucket += inc;
+      pacer->bucket = clib_min (pacer->bucket + inc, pacer->bytes_per_sec);
     }
 
   return clib_min (pacer->bucket, TRANSPORT_PACER_MAX_BURST);
@@ -598,13 +599,21 @@ static inline void
 spacer_set_pace_rate (spacer_t * pacer, u64 rate_bytes_per_sec)
 {
   ASSERT (rate_bytes_per_sec != 0);
+  pacer->bytes_per_sec = rate_bytes_per_sec;
   pacer->tokens_per_period = rate_bytes_per_sec / transport_pacer_period;
 }
 
 static inline u64
 spacer_pace_rate (spacer_t * pacer)
 {
-  return pacer->tokens_per_period * transport_pacer_period;
+  return pacer->bytes_per_sec;
+}
+
+static inline void
+spacer_reset_bucket (spacer_t * pacer, u64 norm_time_now)
+{
+  pacer->last_update = norm_time_now;
+  pacer->bucket = 0;
 }
 
 void
@@ -645,6 +654,14 @@ transport_connection_tx_pacer_burst (transport_connection_t * tc,
   return spacer_max_burst (&tc->pacer, time_now);
 }
 
+void
+transport_connection_tx_pacer_reset_bucket (transport_connection_t * tc,
+                                           u64 time_now)
+{
+  time_now >>= SPACER_CPU_TICKS_PER_PERIOD_SHIFT;
+  spacer_reset_bucket (&tc->pacer, time_now);
+}
+
 u32
 transport_connection_snd_space (transport_connection_t * tc, u64 time_now,
                                u16 mss)
@@ -656,9 +673,10 @@ transport_connection_snd_space (transport_connection_t * tc, u64 time_now,
     {
       time_now >>= SPACER_CPU_TICKS_PER_PERIOD_SHIFT;
       max_paced_burst = spacer_max_burst (&tc->pacer, time_now);
-      max_paced_burst = (max_paced_burst < mss) ? 0 : max_paced_burst;
+      max_paced_burst =
+       (max_paced_burst < TRANSPORT_PACER_MIN_BURST) ? 0 : max_paced_burst;
       snd_space = clib_min (snd_space, max_paced_burst);
-      snd_space = snd_space - snd_space % mss;
+      return snd_space >= mss ? snd_space - snd_space % mss : snd_space;
     }
   return snd_space;
 }