[TCP]: Do not overflow 16-bit window field in tcp_select_window().

Signed-off-by: David S. Miller <davem@redhat.com>

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 292dc9fc0b6d9b433989abe6785ea976df986c52..68ab99fc0370190e9a3a3aa4fa95287209e69710 100644 (file)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -168,6 +168,14 @@ static __inline__ u16 tcp_select_window(struct sock *sk)
        tp->rcv_wnd = new_win;
        tp->rcv_wup = tp->rcv_nxt;
 
+       /* Make sure we do not exceed the maximum possible
+        * scaled window.
+        */
+       if (!tp->rcv_wscale)
+               new_win = min(new_win, MAX_TCP_WINDOW);
+       else
+               new_win = min(new_win, (65535U << tp->rcv_wscale));
+
        /* RFC1323 scaling applied */
        new_win >>= tp->rcv_wscale;