[PATCH] dhcp: fix overflow causing retries to stop

James Prestwood <[email protected]> Mon, 8 Jan 2024 20:06:21 -0800
Newsgroups dev.linux.lists.ell
Message-ID <[email protected]>
If DHCP is in a SELECTING/REQUESTING state and the number of attempts
reached a value where 2 << attempts overflowed an unsigned int the
next timeout would become zero, causing DHCP to never retry.

Since 5 attempts results in a value of 64 we can instead just limit
the attempts to 5, and set next_timeout to 64 after that as the spec
requires.

Fixes: f130c448 ("dhcp: Introduce timeout fuzzing")
---
 ell/dhcp.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/ell/dhcp.c b/ell/dhcp.c
index ece3e23..4f8b369 100644
--- a/ell/dhcp.c
+++ b/ell/dhcp.c
@@ -557,9 +557,14 @@ static void dhcp_client_timeout_resend(struct l_timeout *timeout,
 		 * RFC 2131 Section 4.1:
 		 * "The retransmission delay SHOULD be doubled with subsequent
 		 * retransmissions up to a maximum of 64 seconds.
+		 *
+		 * More than 5 attempts will trigger the maximum, don't increase
+		 * any more to avoid overflowing next_timeout.
 		 */
-		client->attempt += 1;
-		next_timeout = minsize(2 << client->attempt, 64);
+		if (client->attempt > 5)
+			next_timeout = 64;
+		else
+			next_timeout = 2 << client->attempt++;
 		break;
 	case DHCP_STATE_INIT:
 	case DHCP_STATE_INIT_REBOOT:
-- 
2.34.1