kern/53778: snd_wl1 & snd_wl2 not updated in TCP fast path

[siyuz%bostondynamics.com@localhost]

>Number:         53778
>Category:       kern
>Synopsis:       snd_wl1 & snd_wl2 not updated in TCP fast path
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Dec 11 16:20:00 +0000 2018
>Originator:     Steven Zhang
>Release:        
>Organization:
Boston Dynamics
>Environment:
N/A
>Description:
In tcp_input.c, the TCP fast path does not update snd_wl1 and snd_wl2. If the stream stays on the fast path long enough for th_ack or th_seq to wrap, the sequence number check in "step6" will fail and ignore future window updates.

Since the window size is automatically reduced by the amount of data acked when not on the fast path (tcp_input.c:2589), this can cause send window to close and not reopen.

This problem was discovered in a different OS that had a TCP stack based on NetBSD, but appears to be present in NetBSD as well.

>How-To-Repeat:
Transmit enough data to cause th_ack to wrap. Have the receiver start sending window updates. Eventually the sending window will close and will not reopen.
>Fix:
This bug was fixed in FreeBSD in 2002:

https://github.com/freebsd/freebsd/commit/b6176d93b1df287a5a9776b3de562aef877b931c