When the dynamic TCP update is reducing so->so_snd.sb_hiwat the

sbspace() in the socket buffer shrinks.  So a writable socket
reported by poll(2) could become unwritable before calling write(2).
Ensure that a writable or readable socket can still be written to
or read from after changing the buffer size.
Discussed with and OK millert@ deraadt@ claudio@

1 files changed, 14 insertions, 1 deletions

diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c
index e2464dc5717..8dc00e67f38 100644
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_usrreq.c,v 1.126 2015/07/15 22:16:42 deraadt Exp $	*/
+/*	$OpenBSD: tcp_usrreq.c,v 1.127 2015/08/27 17:10:45 bluhm Exp $	*/
 /*	$NetBSD: tcp_usrreq.c,v 1.20 1996/02/13 23:44:16 christos Exp $	*/
 
 /*
@@ -980,6 +980,14 @@ tcp_update_sndspace(struct tcpcb *tp)
 		nmax = MIN(sb_max, so->so_snd.sb_wat + tp->snd_max -
 		    tp->snd_una);
 
+	/* a writable socket must be preserved because of poll(2) semantics */
+	if (sbspace(&so->so_snd) >= so->so_snd.sb_lowat) {
+		if (nmax < so->so_snd.sb_cc + so->so_snd.sb_lowat)
+			nmax = so->so_snd.sb_cc + so->so_snd.sb_lowat;
+		if (nmax * 2 < so->so_snd.sb_mbcnt + so->so_snd.sb_lowat)
+			nmax = (so->so_snd.sb_mbcnt+so->so_snd.sb_lowat+1) / 2;
+	}
+
 	/* round to MSS boundary */
 	nmax = roundup(nmax, tp->t_maxseg);
 
@@ -1012,6 +1020,11 @@ tcp_update_rcvspace(struct tcpcb *tp)
 			    tcp_autorcvbuf_inc);
 	}
 
+	/* a readable socket must be preserved because of poll(2) semantics */
+	if (so->so_rcv.sb_cc >= so->so_rcv.sb_lowat &&
+	    nmax < so->so_snd.sb_lowat)
+		nmax = so->so_snd.sb_lowat;
+
 	if (nmax == so->so_rcv.sb_hiwat)
 		return;